Be SAMA Ready. Not SAMA Reactive.
Create a defensible SAMA compliance program backed by year-round evidence, governance, and risk oversight.
The Compliance Gap
Where Most SAMA Programs Break Down
SAMA compliance is about proving the right policies have been working consistently, and most programs struggle with exactly that part.
Manual GRC work creates evidence gaps that surface during a SAMA review
Incomplete evidence costs more than weak controls during a SAMA review
Without automation, breaches run longer and cost more, every time.
Vendor risk is mostly the largest exposure and also the least-managed one.
SAMA CSF and NCA ECC-2:2024 run as separate programs but, your exposure is unified.
Aelum’s Approach
We Operationalize Compliance. Not Only Advise It.
Headcount is never a compliance strategy. We build ServiceNow environments where policies, controls, evidence, and reporting connect automatically, so the program runs whether or not your GRC lead is in the office.
1
2
3
4
5
SAMA Gap Assessment
We evaluate your SAMA posture against the same evidence standards SAMA assessors apply and produce a prioritized remediation plan by domain.
ServiceNow Architecture
We design your ServiceNow GRC environment to map directly to SAMA domains, connecting controls, policies, evidence, and workflows in one structured place.
GRC Implementation
We deploy and configure ServiceNow GRC so controls are automated, workflows activate on schedule, and compliance no longer depends on manual effort.
Real-Time Monitoring
Continuous control monitoring is configured so evidence accumulates in real time and gaps are identified before they become findings during assessment.
Audit Readiness
Your annual self-assessment report is generated from live, continuously maintained data.
SAMA Maturity Model
The Map from Where You Are to Level 3
Non-Existent
No controls, no documentation, no awareness of cybersecurity risk.
L0
Ad-Hoc
Controls exist inconsistently, varying by owner, with no formal design or structure.
L1
Repeatable
Controls run on informal practice alone: no formal definition, approval, or testing.
L2
Mandatory Minimum
Structured
Controls are defined, board-approved, evidenced, and monitored through a GRC tool.
L3
Managed
Controls are measured for effectiveness using KRIs, with data-driven leadership reporting.
L4
Adaptive
Continuous improvement and performance benchmarked against sector peers.
L5
L0
Non-Existent
No controls, no documentation, no awareness of cybersecurity risk.
L1
Ad-Hoc
Controls exist inconsistently, varying by owner, with no formal design or structure.
L2
Repeatable
No controls, no documentation, no awareness of cybersecurity risk.
L3
Mandatory Minimum
Structured
Controls are defined, board-approved, evidenced, and monitored through a GRC tool.
L4
Managed
Controls are measured for effectiveness using KRIs, with data-driven leadership reporting.
L5
Adaptive
Continuous improvement and performance benchmarked against sector peers.
SAMA Assessment Readiness Checklist
25 questions mapped to all four SAMA domains. Score your program before SAMA does.
- All four domains covered: Governance, Risk Management, Operations, Third-Party
- 25 assessor-level questions to test what your program can actually evidence
- Maturity scoring guide with a clear breakdown by level
- The five things a manual compliance program cannot prove under direct scrutiny
- What SAMA tests beyond controls: evidence consistency, board accountability, vendor trail
Score Your Program Before SAMA Does
Get the checklist used by Saudi financial institutions preparing for their next assessment cycle.
Frequently Asked Questions
What exactly is the SAMA Cybersecurity Framework, and who does it apply to ?
What exactly is the SAMA Cybersecurity Framework, and who does it apply to ? The SAMA Cybersecurity Framework sets mandatory cybersecurity requirements across four domains for every Saudi Central Bank-regulated entity, including banks, insurers, financing companies, payment service providers, fintechs, and financial market infrastructure operators.
What is the 2030 deadline, and what happens if we miss it?
What is the 2030 deadline, and what happens if we miss it? There is no SAMA CSF-specific 2030 deadline. The framework has been mandatory since 2018 through annual self-assessments. Vision 2030 continues to raise regulatory expectations. Newly licensed banks must reach Level 3 within 18 months of licensing and Level 4 within three years.
We already have ISO 27001. How much of SAMA CSF does that cover?
We already have ISO 27001. How much of SAMA CSF does that cover? ISO 27001 reduces remediation workload in governance and technical controls but does not satisfy SAMA alone. The remaining gap typically includes board accountability structures, CISO designation, SAMA-format self-assessment reporting, and third-party risk requirements specific to SAMA’s supervisory authority.
How long does it take to achieve SAMA compliance?
How long does it take to achieve SAMA compliance? Level 0-1 organizations should plan for 3-6 months to reach a defensible Level 3. Level 2 organizations move faster, especially with GRC deployment accelerating evidence of collection. Legacy system complexity can extend timelines.
What role does ServiceNow GRC play in SAMA compliance?
What role does ServiceNow GRC play in SAMA compliance? SAMA’s own maturity model requires GRC tooling at Level 3, making a platform like ServiceNow a regulatory requirement. ServiceNow GRC and IRM address all four domains: policy management, risk registers, access control, vulnerability response, incident management, asset classification, and third-party vendor monitoring.
Do our third-party vendors and outsourcing partners need to be SAMA compliant as well?
Do our third-party vendors and outsourcing partners need to be SAMA compliant as well? Not directly, but you carry the liability. SAMA holds regulated institutions fully accountable for breaches originating in their vendor ecosystem. You must assess vendors before onboarding, enforce contractual cybersecurity obligations, and continuously monitor critical suppliers’ security posture.
We're a small financing company, do we still need to be SAMA compliant?
We're a small financing company, do we still need to be SAMA compliant? Yes, in terms of the Level 3 minimum requirement, entity size does not reduce SAMA’s mandatory threshold. All SAMA-regulated financing companies must reach Level 3.