What does business continuity compliance mean in Saudi Arabia?
In short: For SAMA-regulated financial institutions it means implementing SAMA's Business Continuity Management (BCM) Framework, in force since February 2017, which all Member Organisations must integrate formally into their BCM programme. For government entities and critical infrastructure operators, NCA ECC-2:2024 adds a Cybersecurity Resilience domain covering the cybersecurity aspects of business continuity. Many organisations use ISO 22301 — one of the standards SAMA's framework draws on — as the common method.
Which business continuity rules apply to you
| Framework | Who it applies to | What it requires |
|---|---|---|
| SAMA Business Continuity Management Framework (February 2017) | All SAMA Member Organisations | A formal BCM programme that meets SAMA's requirements. The framework draws on ISO 22301, ISO 27001, the BCI Good Practice Guidelines and DRII professional practices. |
| NCA ECC-2:2024 — Cybersecurity Resilience domain | Government entities and Critical National Infrastructure operators | Cybersecurity requirements built into business continuity management (the domain's single subdomain). |
| SAMA Cyber Resilience Fundamental Requirements (CRFR) | Entities seeking a SAMA licence or entry to SAMA's Regulatory Sandbox | A Resilience domain covering business continuity and disaster recovery plans, and backup and restoration — alongside, not instead of, the full CSF and BCM frameworks. |
| ISO 22301:2019 | Any organisation (voluntary, certifiable) | Requirements for a business continuity management system (BCMS). |
Core components of a BCM programme
Programmes built on ISO 22301 — the main international standard behind SAMA's framework — typically include the following components. Map each one to the specific SAMA or NCA requirement it satisfies so evidence is easy to produce.
- 1
Governance and policy
A board-approved BCM policy, defined scope, roles and a senior owner accountable for continuity.
- 2
Business impact analysis (BIA)
Identify critical activities and their dependencies, and set recovery time and recovery point objectives for each.
- 3
Risk assessment
Assess the threats that could disrupt critical activities — including cyber attacks, technology failure, loss of premises and third-party failure.
- 4
Continuity and recovery strategies
Choose how each critical activity will continue or recover: alternate sites, redundancy, manual workarounds, backup and restoration.
- 5
Plans and crisis management
Documented business continuity, disaster recovery and crisis communication plans with clear activation criteria.
- 6
Testing and exercising
Regular tabletop, technical recovery and full exercises, with lessons learned tracked to closure.
- 7
Review and improvement
Periodic review of the programme, and updates after incidents, tests or significant change.
Key business continuity terms
| Term | Meaning |
|---|---|
| BIA | Business impact analysis — how disruption to an activity would affect the organisation over time. |
| RTO | Recovery time objective — the target time to resume an activity after disruption. |
| RPO | Recovery point objective — the maximum acceptable data loss, measured as time since the last good copy. |
| MTPD | Maximum tolerable period of disruption — the point after which the impact becomes unacceptable. |
| BCP / DRP | Business continuity plan (keeping the business running) and disaster recovery plan (restoring technology). |
Where cyber resilience fits
Ransomware and destructive attacks have made cyber resilience the most tested part of continuity. That is why NCA ECC-2:2024 places resilience in a dedicated domain and why SAMA's CRFR lists backup and restoration among its fundamental requirements. Treat backup restoration tests and cyber incident scenarios as standard BCM exercises, and record cyber continuity risks in the same enterprise risk register as other operational risks.
Business continuity compliance checklist
- Confirm which frameworks apply: SAMA BCM, NCA ECC resilience, CRFR, or a combination.
- Approve a BCM policy and assign an accountable senior owner.
- Complete a business impact analysis with RTO and RPO for every critical activity.
- Include cyber attack, technology failure and third-party failure scenarios in the risk assessment.
- Document business continuity, disaster recovery and crisis communication plans.
- Test plans regularly, including backup restoration, and track lessons learned to closure.
- Cover critical vendors in continuity planning and contracts.
- Review the programme periodically and after every major incident or change.
Frequently asked questions
Is business continuity management mandatory for Saudi banks?
Yes. SAMA's Business Continuity Management Framework states that all Member Organisations are required to comply with its requirements and integrate them formally in their BCM programme.
What is the SAMA BCM Framework based on?
SAMA's framework draws on its own requirements, industry practice and international standards and guidance, including ISO 22301, ISO 27001, the BCI Good Practice Guidelines and DRII professional practice guidelines.
Does ISO 22301 certification satisfy SAMA?
ISO 22301 gives you a strong, recognised management system that covers much of what SAMA expects, but certification is not a substitute for meeting SAMA's own framework. Map your ISO 22301 controls to SAMA's requirements and close any gaps.
What is the difference between RTO and RPO?
RTO (recovery time objective) is how quickly an activity must be restored. RPO (recovery point objective) is how much data you can afford to lose, measured as the time since the last good backup.
What does NCA ECC require for business continuity?
NCA ECC-2:2024 has a Cybersecurity Resilience domain with a single subdomain covering the cybersecurity aspects of business continuity management, which in-scope government and CNI entities must implement.
How does Siraaj support business continuity compliance?
Siraaj's regulatory compliance library maps SAMA BCM and NCA resilience obligations to controls, owners and evidence, while the risk register, key risk indicators and incident management keep continuity risks and disruptions in one view.
Sources
The official texts and expert commentary this page is based on. Always confirm requirements against the current version published by the regulator.
- Business Continuity Management Framework — Saudi Central Bank (SAMA)
- SAMA Rulebook: Introduction to the BCM Framework — Saudi Central Bank (SAMA)
- Essential Cybersecurity Controls (ECC-2:2024) — National Cybersecurity Authority (NCA)
- SAMA Rulebook: Cyber Resilience Fundamental Requirements — Saudi Central Bank (SAMA)
- ISO 22301:2019 Business continuity management systems — Requirements — International Organization for Standardization (ISO)
Related guides
Keep continuity evidence audit-ready
Map SAMA BCM and NCA resilience requirements to owners, controls and evidence, and track continuity risks and incidents alongside the rest of your risk register.