What is a cybersecurity maturity assessment?
In short: A cybersecurity maturity assessment measures how well-established your security controls are, not just whether they exist. In Saudi Arabia the reference point for financial institutions is the SAMA Cyber Security Framework's six-level maturity model, from Level 0 (Non-existent) to Level 5 (Adaptive), where Level 3 (Structured and formalised) is the minimum SAMA expects. Government and critical infrastructure entities assess their implementation of the 108 main controls in NCA ECC-2:2024.
SAMA's six cyber security maturity levels
| Level | Name | What it looks like in practice |
|---|---|---|
| Level 0 | Non-existent | The control is not in place. |
| Level 1 | Ad-hoc | The control is partly defined and applied inconsistently, depending on individuals. |
| Level 2 | Repeatable but informal | The control is applied repeatedly but is not formally documented or approved. |
| Level 3 | Structured and formalised | The control is documented, approved and implemented — the minimum SAMA expects. |
| Level 4 | Managed and measurable | The control's effectiveness is measured and monitored. |
| Level 5 | Adaptive | The control is continuously improved based on measurement and changing threats. |
SAMA's IT Governance Framework takes the same approach for IT controls: Member Organisations complete periodic self-assessments using a questionnaire, which SAMA audits to determine the level of compliance and IT maturity.
How compliance is assessed in Saudi Arabia
SAMA Cyber Security Framework
Implementation is subject to periodic self-assessment by the Member Organisation (CSF section 2.3, Self-Assessment, Review and Audit), which SAMA reviews and audits. Each control is rated against the six-level maturity model.
NCA ECC-2:2024
Government entities and CNI operators must implement and demonstrate compliance with the ECC's 4 domains, 28 subdomains, 108 main controls and 92 subcontrols. Assessment focuses on whether each control is implemented and evidenced.
SAMA CRFR
New entrants seeking a licence or sandbox entry are assessed against SAMA's Cyber Resilience Fundamental Requirements, a baseline aligned with the CSF and BCM frameworks.
ISO 27001
A certifiable international standard often run alongside the Saudi frameworks. See our ISO 27001 vs NCA ECC comparison.
How to run a cybersecurity maturity assessment in 6 steps
- 1
Set scope and framework
Decide which framework applies (SAMA CSF, NCA ECC or both), which entities and systems are in scope, and the target level — Level 3 at minimum for SAMA.
- 2
Collect evidence per control
For every control, gather policies, approvals, configurations, logs and reports. A rating without evidence will not survive SAMA review.
- 3
Rate each control
Score implementation and maturity per control using the framework's definitions, and record who rated it and why.
- 4
Aggregate by domain and subdomain
Roll ratings up to see where weaknesses cluster — often policy approval, third-party security or monitoring.
- 5
Analyse gaps against your target
List every control below the target level, its risk and the effort to close it.
- 6
Build and track a remediation roadmap
Assign owners and dates, report progress to leadership, and reassess after remediation and at least annually.
Why organisations score below Level 3
- Policies exist in draft but have never been formally approved.
- Controls depend on individuals and are not applied consistently across business units.
- There is no evidence trail — the control works, but nobody can prove it.
- Third-party and cloud controls lag behind internal controls.
- Ratings were self-reported without challenge from risk, compliance or internal audit.
Frequently asked questions
What is the minimum SAMA cyber security maturity level?
SAMA expects Member Organisations to operate at maturity Level 3 (Structured and formalised) or higher.
How many maturity levels are in the SAMA Cyber Security Framework?
Six: Level 0 Non-existent, Level 1 Ad-hoc, Level 2 Repeatable but informal, Level 3 Structured and formalised, Level 4 Managed and measurable, and Level 5 Adaptive.
Who performs the SAMA cyber security assessment?
Member Organisations perform periodic self-assessments under the framework's Self-Assessment, Review and Audit section, and SAMA reviews and audits them.
Is a maturity assessment the same as an audit?
No. A maturity assessment rates how established each control is, usually led by the first or second line. An audit independently tests whether controls work as described. Internal audit often validates the self-assessment before it goes to the regulator.
How often should we reassess cyber maturity?
Follow your regulator's assessment cycle, and in practice reassess at least annually and after major changes such as a new system, a merger or a significant incident.
How does Siraaj support maturity assessments?
Siraaj maps SAMA and NCA controls into a live control library with owners and evidence, tracks maturity against your target, and runs risk and control self-assessments (RCSA) with remediation tracking.
Sources
The official texts and expert commentary this page is based on. Always confirm requirements against the current version published by the regulator.
- Cyber Security Framework (v1.0) — Saudi Central Bank (SAMA)
- SAMA Rulebook: Cyber Security Framework — Saudi Central Bank (SAMA)
- SAMA Rulebook: Information Technology Governance Framework — Saudi Central Bank (SAMA)
- SAMA Rulebook: Cyber Resilience Fundamental Requirements — Saudi Central Bank (SAMA)
- Essential Cybersecurity Controls (ECC-2:2024) — National Cybersecurity Authority (NCA)
Related guides
See your maturity, control by control
Siraaj GRC turns SAMA and NCA controls into a live library with owners, evidence and maturity ratings, so your next self-assessment starts from current data.