What does SAMA compliance software do?
In short: SAMA compliance software turns the Saudi Central Bank's frameworks — chiefly the Cyber Security Framework, plus the Business Continuity Management and IT Governance frameworks — into a live control library. Each requirement is mapped to an owner, a control and evidence; maturity is tracked against SAMA's Level 3 minimum; and the evidence for periodic self-assessments and SAMA reviews is kept current instead of being rebuilt every cycle.
SAMA frameworks a compliance platform should cover
| Framework | Applies to | Key points |
|---|---|---|
| Cyber Security Framework (May 2017) | All SAMA Member Organisations | 4 domains; six-level maturity model (Level 0–5) with Level 3 as the minimum; periodic self-assessment reviewed and audited by SAMA. See the SAMA CSF guide. |
| Business Continuity Management Framework (February 2017) | All SAMA Member Organisations | A formal BCM programme drawing on ISO 22301 and other standards. See business continuity in KSA. |
| IT Governance Framework (2021) | SAMA Member Organisations | Four domains — IT governance and leadership, IT risk management, IT operations management, system change management — with periodic self-assessments audited by SAMA. |
| Cyber Resilience Fundamental Requirements (2022) | Entities seeking a SAMA licence or Regulatory Sandbox entry | A baseline across leadership and governance, operations and technology, and resilience, aligned with the CSF and BCM frameworks. |
| Outsourcing and cloud rules | Banks and Member Organisations | SAMA approval before material outsourcing and before using cloud services. See third-party risk management. |
How Siraaj supports SAMA compliance
SAMA control library
SAMA requirements mapped into a live control library with owners, controls and an evidence repository — the same library also covers NCA, PDPL, CMA and ZATCA.
Maturity tracking
Track each control against SAMA's maturity model and see where you sit relative to Level 3, domain by domain.
Risk dashboard with SAMA thresholds
A real-time risk dashboard with overall risk score, trends, SAMA threshold analysis and alerts.
RCSA and key risk indicators
Risk and control self-assessments, control effectiveness monitoring and KRIs with threshold-based alerting.
Vendor and cloud oversight
A register of third parties and processors with risk tiering, agreements and periodic reviews.
Audit and board reporting
Findings and corrective actions tracked to closure, with audit committee dashboards and reports exportable to PDF and PowerPoint.
Manual vs automated SAMA compliance
| Manual approach | With a SAMA compliance platform | |
|---|---|---|
| Self-assessment | Questionnaire rebuilt each cycle from scattered files | Ratings and evidence maintained continuously per control |
| Maturity | Point-in-time estimate | Tracked per control and domain against the Level 3 target |
| Evidence | Collected under deadline pressure | Linked to each control as work happens |
| Overlaps | SAMA, NCA and PDPL tracked separately | One control evidences every framework it satisfies |
| Reporting | Manual slides for the board and audit committee | Dashboards and exportable reports |
Who uses SAMA compliance software
- Banks and their technology, risk and compliance teams
- Insurance and reinsurance companies
- Finance companies and credit providers
- Fintechs and payment providers preparing for licensing (CRFR) and full CSF compliance
Frequently asked questions
What is SAMA compliance software?
Software that maps the Saudi Central Bank's requirements — mainly the Cyber Security Framework, BCM Framework and IT Governance Framework — to controls, owners and evidence, and tracks maturity and remediation so self-assessments and SAMA reviews are evidence-ready.
Which SAMA frameworks should it cover?
At minimum the Cyber Security Framework. Most Member Organisations also need the Business Continuity Management Framework, the IT Governance Framework and SAMA's outsourcing and cloud requirements; new entrants need the Cyber Resilience Fundamental Requirements.
Does compliance software replace SAMA's self-assessment?
No. Member Organisations still perform the self-assessment and SAMA still reviews it. The software keeps ratings, evidence and remediation current so the self-assessment reflects reality and takes far less effort.
What maturity level does SAMA require?
SAMA expects Member Organisations to operate at cyber security maturity Level 3 (Structured and formalised) or higher.
Is Siraaj suitable for fintechs?
Yes. Siraaj's regulatory libraries and automated workflows are designed for fintechs and financing companies as well as larger institutions, from licensing-stage baselines to full CSF compliance.
Does Siraaj also cover NCA ECC and PDPL?
Yes. The same control library maps NCA ECC, PDPL, CMA and ZATCA obligations, so a control that satisfies several frameworks is evidenced once.
Sources
The official texts and expert commentary this page is based on. Always confirm requirements against the current version published by the regulator.
- Cyber Security Framework (v1.0) — Saudi Central Bank (SAMA)
- SAMA Rulebook: Cyber Security Framework — Saudi Central Bank (SAMA)
- Business Continuity Management Framework — Saudi Central Bank (SAMA)
- SAMA Rulebook: Information Technology Governance Framework — Saudi Central Bank (SAMA)
- SAMA Rulebook: Cyber Resilience Fundamental Requirements — Saudi Central Bank (SAMA)
- SAMA Rulebook: Cyber Security Framework 3.4 Third Party Cyber Security — Saudi Central Bank (SAMA)
Related guides
Stay SAMA-ready all year, not just at assessment time
See how Siraaj GRC maps the SAMA Cyber Security Framework into a live control library, tracks your maturity and keeps evidence ready for SAMA review.