Cyber Resilience
Fundamental Requirements

Establish a governance structure with clear roles, responsibilities and resource allocation for cyber security and resilience.

Develop, approve and communicate cyber security policies and procedures that align with SAMA requirements and the entity's risk appetite.

Review and update policies periodically — and whenever there is a material change in the threat landscape or business operating model.

Integrate cyber security into business operating models, product development lifecycles and outsourcing arrangements.

Implement and enforce a strong password policy covering complexity, length, rotation, history and prohibition of shared credentials.

Conduct comprehensive IT and cyber risk assessments with centralised documentation, and review findings against the entity's risk appetite.

Implement identity and access management processes based on least-privilege and need-to-know principles, including privileged access controls.

Establish a change management process that includes security requirements, testing, approval and rollback procedures for all system changes.

Design and maintain a secure network architecture with appropriate segmentation to isolate sensitive systems and limit lateral movement.

Apply cryptography and encrypted communications for data at rest and in transit, using industry-standard protocols and key management practices.

Conduct periodic vulnerability assessments across infrastructure, applications and third-party components, and remediate findings within defined timelines.

Perform penetration testing at minimum twice annually across all critical systems and customer-facing applications.

Implement a patch management process with defined timelines for critical, high and medium-severity patches across all systems and software.

Embed security into the software development lifecycle — including threat modelling, secure coding standards and application shielding techniques.

Monitor for brand abuse, phishing domains, impersonation and fraudulent use of the entity's name, logo or products.

Deploy antivirus, anti-malware and mobile device encryption on all endpoints, with centralised management and automated signature updates.

Collect security logs from all critical systems and retain them for a minimum of one year to support incident investigation and forensic analysis.

Integrate log sources into a Security Information and Event Management (SIEM) system to enable correlation, alerting and threat detection.

Operate continuous security monitoring with defined detection use-cases, alert thresholds and escalation paths for security events.

Establish and test an incident management process covering detection, containment, eradication, recovery, lessons-learned and post-incident review.

Configure session timeouts so that inactive sessions do not exceed five minutes, and enforce re-authentication after session expiry.

Report medium-severity and above cyber, fraud and disruptive incidents to SAMA within defined notification timelines.

Define, document and periodically test a Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) covering critical systems and services.

Implement encrypted backups with offline storage capability, and regularly test restoration procedures to verify recovery point and time objectives are met.