For banks, insurers and finance companies in the Kingdom, Level 3 is the line that matters. The jump from Level 2 is less about new technology than about proving that what you do is defined, approved and done the same way every time.
The Saudi Central Bank (SAMA) issued its Cyber Security Framework in 2017 for the organisations it regulates, including banks, insurance and reinsurance companies, finance companies, credit bureaus and financial market infrastructure. The framework sets out what good cyber security looks like for these member organisations and how SAMA measures it.
Its most practical feature is the maturity model. Rather than a pass or fail, each control is rated on a scale, and SAMA expects member organisations to reach at least Level 3. This article explains what the levels mean and what it typically takes to move from Level 2 to Level 3.
The four domains
- Cyber Security Leadership and Governance: strategy, the cyber security committee, the CISO role, policies, roles and responsibilities, awareness and training, and cyber security in project management.
- Cyber Security Risk Management and Compliance: risk management processes, regulatory compliance, compliance with SAMA requirements, and cyber security review and audit.
- Cyber Security Operations and Technology: human resources security, physical security, asset management, architecture, identity and access management, application and change management, infrastructure security, cryptography, mobile and bring-your-own-device, secure disposal, payment systems, electronic banking services, cyber security event management, incident management, threat management and vulnerability management.
- Third Party Cyber Security: contract and vendor management, outsourcing and cloud computing.
The maturity levels
| Level | Name | What it looks like |
|---|---|---|
| 0 | Non-existent | No control in place, no awareness of the need. |
| 1 | Ad-hoc | Done occasionally, inconsistently, depending on individuals. |
| 2 | Repeatable but informal | Done regularly in practice, but not documented or approved. |
| 3 | Structured and formalised | Defined, documented, approved and implemented consistently. |
| 4 | Managed and measurable | Performance measured with indicators and reviewed periodically. |
| 5 | Adaptive | Continuously improved, driven by measurement and business change. |
The key distinction is between Levels 2 and 3. At Level 2, the work happens because experienced people know to do it. At Level 3, it happens because the organisation has decided it must, written down how, approved that decision at the right level, and can show it being followed.
Why organisations get stuck at Level 2
Many financial institutions have capable security teams and good tools. They still score Level 2 on a large number of controls for a handful of predictable reasons:
- Procedures live in people's heads, or in documents that were never formally approved.
- Policies exist but describe an ideal rather than what actually happens.
- Controls are applied to some systems or business units and not others.
- Evidence is incomplete, so the assessor cannot verify consistency.
None of these is solved by buying another product. They are solved by governance discipline.
Getting to Level 3, domain by domain
Leadership and governance
Make sure the cyber security strategy is approved by the board or its delegate and aligned with the business strategy. Establish the cyber security committee with a charter, membership and a regular meeting record. Confirm the CISO role, its reporting line and its independence. Approve the policy set, and make sure each policy has an owner and a review date. Run an awareness programme with tracked completion, and include cyber security checkpoints in project methodology.
Risk management and compliance
Adopt a documented risk methodology and apply it to all critical assets and processes, not only to the ones the team happens to know about. Keep a risk register with owners, treatment plans and dates. Track regulatory requirements in one compliance register, and schedule internal reviews and independent audits against it.
Operations and technology
This is the largest domain and the one where Level 2 is most common. For each control area, write the procedure that reflects how the work is done, get it approved, and apply it everywhere in scope. Typical priorities:
- Identity and access: documented joiner, mover and leaver processes, privileged access management, and recorded periodic access reviews.
- Change management: security sign-off as a formal step, with records for every change to critical systems.
- Vulnerability management: defined scanning frequency, remediation timelines by severity, and exception handling.
- Event and incident management: documented use cases, escalation paths, and an incident response plan that is tested and updated.
- Asset management: a complete inventory with owners and classification, because almost every other control depends on it.
Third party cyber security
Standardise security clauses in contracts, assess vendors before onboarding and periodically after, and apply SAMA's specific requirements for outsourcing and cloud. Keep the evidence for each critical vendor in one place.
Evidence assessors expect
For each control at Level 3, be ready to show:
- The approved policy or standard that requires it.
- The procedure that describes how it is done.
- Records showing it done consistently over a period, across all in-scope systems.
- The owner responsible for it.
Looking past Level 3
Once controls are formalised, Level 4 is about measurement. Define a small set of meaningful indicators, such as time to remediate critical vulnerabilities, percentage of privileged accounts reviewed on schedule, or mean time to detect, and review them at the committee. Organisations that design their Level 3 processes with measurement in mind find Level 4 a natural next step rather than a second project.
If you would like an independent view of where your controls sit today, our GRC team runs SAMA CSF gap assessments, and our free maturity assessment gives a quick first indication.