What is third-party risk management in Saudi Arabia?
In short: Third-party risk management (TPRM) is how an organisation identifies, assesses and monitors the risks that come from vendors, outsourcing providers and cloud services. In Saudi Arabia it is a regulatory requirement, not just good practice: the SAMA Cyber Security Framework has a dedicated Third Party Cyber Security domain, NCA ECC-2:2024 has a Third-Party and Cloud Computing Cybersecurity domain, and SAMA expects its approval before material outsourcing and before using cloud services.
Most serious incidents now arrive through a supplier: a managed service provider with privileged access, a SaaS platform holding customer data, or a cloud tenant misconfiguration. Saudi regulators have responded by writing third-party requirements directly into their frameworks, so a TPRM programme is part of SAMA compliance and NCA ECC compliance rather than a separate procurement exercise.
What Saudi regulators require for third parties
| Framework | Who it applies to | Third-party requirements |
|---|---|---|
| SAMA Cyber Security Framework — Domain 3.4 | SAMA-regulated Member Organisations (banks, insurers, finance companies) | Three subdomains: Contract and Vendor Management (security requirements before signing, right to periodically review and audit, confidentiality, exit requirements), Outsourcing (SAMA approval before material outsourcing) and Cloud Computing (SAMA approval before using cloud services). |
| SAMA Rules on Outsourcing | Banks licensed in the Kingdom | Risk assessment and SAMA permission before outsourcing core functions, and contracts covering service levels, audit rights, business continuity, confidentiality, information security and exit. |
| NCA ECC-2:2024 — Domain 4 | Government entities and Critical National Infrastructure operators | Two subdomains: Third-Party Cybersecurity and Cloud Computing and Hosting Cybersecurity. |
| Personal Data Protection Law (PDPL) | Any organisation processing personal data in the Kingdom | Personal data you share with vendors stays subject to the PDPL, including its conditions on transferring data outside the Kingdom. |
The third-party risk management lifecycle
- 1
Build a complete third-party inventory
List every vendor, outsourcing provider and cloud service, with the data, systems and business processes each one touches. You cannot tier or monitor what you have not inventoried.
- 2
Tier vendors by inherent risk
Rate each third party on criticality to operations, access to sensitive or personal data, privileged system access and substitutability. Critical and high-risk vendors get the deepest due diligence and the most frequent reviews.
- 3
Run due diligence before signing
Assess security, privacy, financial and continuity posture before the contract — SAMA's Contract and Vendor Management subdomain expects security requirements to be addressed before signing, with the cyber security function involved where needed.
- 4
Write the controls into the contract
Include security requirements, a mutual confidentiality agreement, the right to periodically perform cyber security reviews and audits, incident notification duties and requirements for exiting, terminating or renewing the contract.
- 5
Obtain regulatory approvals
For SAMA-regulated firms, material outsourcing and the use of cloud services require SAMA approval. Build these approvals into your onboarding workflow so they are never skipped.
- 6
Monitor continuously and reassess
Track vendor incidents, SLA breaches, certification expiry and key risk indicators, and reassess each vendor on a cycle set by its tier — not just at renewal.
- 7
Exit cleanly
Plan for termination from day one: data return, irreversible deletion and access revocation, with evidence kept for audit.
Cloud providers: the Saudi-specific rules
Cloud deserves its own policy. SAMA's Cloud Computing subdomain applies to hybrid and public cloud (not private cloud) and sets clear expectations: obtain SAMA approval before using cloud services; in principle use only cloud services located in Saudi Arabia; ensure the provider does not use your data for secondary purposes; keep the right to perform a cyber security audit at the provider; and require the provider to irreversibly delete your data on termination.
Outside the financial sector, the NCA publishes separate Cloud Cybersecurity Controls (CCC) with implementation guides for both cloud service providers and cloud service tenants, alongside the cloud subdomain in ECC-2:2024.
A practical vendor tiering model
Regulators set the outcomes; how you tier is up to you. A common, defensible approach:
| Tier | Typical vendors | Due diligence | Reassessment |
|---|---|---|---|
| Critical | Core banking or payment processors, managed security providers, cloud hosting of production systems | Full security and continuity assessment, on-site or independent assurance, regulator approval where required | At least annually, plus continuous monitoring |
| High | SaaS holding customer or employee personal data, providers with privileged access | Security questionnaire with evidence, PDPL and transfer review | Annually |
| Medium | Business tools with limited internal data | Standard questionnaire | Every two years |
| Low | No data or system access (e.g. facilities, printing) | Basic onboarding checks | At renewal |
Third-party risk management checklist for Saudi organisations
- Maintain a single inventory of all vendors, outsourcing providers and cloud services.
- Tier every third party by criticality, data access and privileged access.
- Involve the cyber security function in due diligence for critical and high-risk vendors.
- Include right-to-audit, confidentiality, incident notification and exit clauses in contracts.
- Obtain SAMA approval before material outsourcing and before using cloud services (SAMA-regulated firms).
- Confirm where cloud and SaaS providers store and process data, and check PDPL transfer conditions.
- Map vendor controls to the NCA ECC Third-Party and Cloud subdomains (government and CNI entities).
- Track vendor incidents, SLA breaches and certification expiry as key risk indicators.
- Reassess vendors on a schedule set by their tier, not only at contract renewal.
- Document data return, deletion and access revocation at exit.
Frequently asked questions
What is third-party risk management (TPRM)?
TPRM is the process of identifying, assessing, mitigating and monitoring risks introduced by vendors, outsourcing providers, cloud services and other third parties across their lifecycle — from due diligence and contracting to ongoing monitoring and exit.
Does SAMA require approval for outsourcing?
Yes. The SAMA Cyber Security Framework's Outsourcing subdomain requires SAMA's approval prior to material outsourcing and compliance with SAMA's outsourcing rules, and its Cloud Computing subdomain requires SAMA approval before using cloud services.
Can SAMA-regulated firms use cloud providers outside Saudi Arabia?
The SAMA Cyber Security Framework states that, in principle, only cloud services located in Saudi Arabia should be used, and SAMA approval is required before using cloud services. Check the current framework and seek SAMA's view before using a provider hosted abroad.
What does NCA ECC require for third parties?
NCA ECC-2:2024 has a Third-Party and Cloud Computing Cybersecurity domain with two subdomains — Third-Party Cybersecurity, and Cloud Computing and Hosting Cybersecurity — which in-scope government and CNI entities must implement.
How often should vendors be reassessed?
Base the frequency on risk tier: critical vendors at least annually with continuous monitoring, high-risk vendors annually, and lower tiers less often. Reassess immediately after a significant incident or a change in the services provided.
How does Siraaj help with third-party risk?
Siraaj's vendor and processor management keeps a processor register, data processing agreements, risk tiering and periodic reviews, while its regulatory compliance library maps SAMA, NCA and PDPL third-party obligations to controls, owners and evidence.
Sources
The official texts and expert commentary this page is based on. Always confirm requirements against the current version published by the regulator.
- SAMA Rulebook: Cyber Security Framework 3.4 Third Party Cyber Security — Saudi Central Bank (SAMA)
- Rules on Outsourcing — Saudi Central Bank (SAMA)
- Essential Cybersecurity Controls (ECC-2:2024) — National Cybersecurity Authority (NCA)
- Cloud Cybersecurity Controls (CCC) — National Cybersecurity Authority (NCA)
- Personal Data Protection Law (English translation) — Saudi Data & AI Authority (SDAIA)
Related guides
Bring every vendor into one risk view
Siraaj GRC keeps your vendor register, risk tiers, due diligence and SAMA/NCA third-party obligations in one place, with reviews and evidence ready for audit.