- SAMA (SCB)

Reach SAMA Level 3. Prove It To The Regulator.

AWJ Tech helps banks, insurers, finance companies and fintechs regulated by the Saudi Central Bank close the gap between where their controls stand today and where SAMA expects them to be. We assess your maturity against all four domains, build the missing policies and evidence, and prepare you for the self-assessment and the audit that follows.

What We Cover

SAMA Cyber Security Framework (CSF), all four domains
Maturity scoring from Level 0 to Level 5
Business Continuity Management (BCM) Framework
Cyber Resilience Fundamental Requirements (CRFR) for new entrants
Red teaming readiness under SAMA’s F.E.E.R. framework

- Industries We Serve

SAMA Compliance Built Around Your Sector

SAMA does not scale its expectations down for smaller institutions. A licensed fintech is measured on the same maturity scale as a national bank, and the minimum acceptable level is the same for both.

Our work starts with your licence, your business model and your current controls, so the programme targets the subdomains SAMA will actually examine instead of producing a generic policy pack nobody uses.

Finance

We assess banks, insurers, finance companies and fintechs against every CSF domain, prioritising the controls SAMA examines most closely during its reviews.

Healthcare

We help health insurers and providers working with SAMA-regulated payers secure patient and claims data to the standard their financial partners require.

Legal

We help law firms and advisory practices serving Saudi banks meet the third-party security requirements SAMA expects its regulated clients to enforce.

Retail & E-Commerce

We align payment integrations, BNPL partnerships and customer data handling with SAMA requirements so your financial partners can approve you faster.

- Why AWJ Tech

Eight Ways We Get You Audit-Ready For SAMA

Each engagement is scoped to your licence, your maturity gap and your next regulatory deadline.

01

Maturity Gap Assessment

We score every applicable control against SAMA’s six-level maturity model, then show you exactly which subdomains fall below Level 3 and what it takes to close each one.

02

Governance & Policy Development

We write and formalise the cyber security strategy, policies, standards and CISO responsibilities that SAMA expects to be approved, versioned and enforced.

03

Risk Management & Compliance

We set up a formal risk methodology, a maintained risk register and treatment plans with named owners, plus ongoing compliance monitoring against SAMA circulars.

04

Operations & Technology Controls

We review identity and access management, network security, logging, SOC capability, vulnerability management and incident response against the CSF control considerations.

05

Third-Party & Cloud Security

We assess outsourcing arrangements, cloud providers and critical vendors, and help you push SAMA requirements down into contracts and ongoing monitoring.

06

Business Continuity (BCM Framework)

We align your business impact analysis, recovery strategies and continuity testing with SAMA’s Business Continuity Management Framework.

07

CRFR & Licensing Support

For entities entering the Saudi financial sector or the SAMA Regulatory Sandbox, we prepare the Cyber Resilience Fundamental Requirements self-assessment and the evidence behind it.

08

Red Teaming Readiness (F.E.E.R.)

We prepare your detection and response teams for threat-intelligence-led red teaming under SAMA’s framework, and run independent penetration tests to clear obvious weaknesses first.

A Policy Document Says You’re Compliant.
SAMA Asks You To Prove It.

AWJ Tech Builds Compliance That Holds Up Under Review

SAMA assesses maturity from evidence: approved documents, working processes, measured results and audit trails. We build all four, so your self-assessment score is one you can defend when the regulator reviews it, not a number your team is hoping holds.

- Why Do Businesses Trust AWJ Tech?

The Credentials Behind Every Promise We Make

- HOW WE WORK

From Gap Analysis To Audit-Ready Evidence

Six stages, a named owner for every gap, and nothing marked complete until the evidence exists.

Stage 1

Scoping & Licence Review

We confirm which SAMA frameworks apply to your licence, which entities and subsidiaries are in scope, and your regulatory deadlines.

Week 0

Stage 2

Current-State Maturity Assessment

Interviews, document review and control testing across all four CSF domains, scored on the 0–5 maturity scale.

Days 1–2

Stage 3

Gap Report & Roadmap

Every gap ranked by regulatory risk, with owners, effort estimates and a realistic path to Level 3 and beyond.

Days 3–7

Stage 4

Remediation Support

We draft policies, design processes, configure controls alongside your team and track progress weekly.

Day 8

Stage 5

Evidence Pack & Self-Assessment

We assemble the evidence for every control and prepare your SAMA self-assessment submission.

Days 9–10

Stage 6

Pre-Audit Review

An independent mock review to test the evidence before SAMA or your external auditor does.

Within 90 days

- Client Reviews

What Clients Say About
SAMA Compliance

"An effective business partner! Throughout our rapid business growth, we were ensured world-class security services despite budget and schedule constraints. Anticipated issues well in advance and provided timely recommendations...."

"Proactive and well liked by our staff due to their 'can do' attitude. When faced with problems, proactively suggested solutions. Took actions and decisions as appropriate to the business."

"I have had the privilege of working with Sadiq. He possesses expert security skills, broad and deep industry knowledge and in-depth understanding of regulatory requirements within the finance industry…”

"A rare breed of folks who are able to hold both deep technical and cyber conversations whilst combining and communicating the business context that helps bridge the gap for all involved."

- Common questions

What Clients Ask About
SAMA Compliance

Is SAMA the same as SCB?

Yes. The Saudi Arabian Monetary Authority was renamed the Saudi Central Bank in 2020 but kept the SAMA acronym. Its cyber security framework is still commonly called the SAMA CSF.

What maturity level do we need to reach?

Level 3 is the minimum for every member organisation. Some areas, especially security operations and event management, are often expected to run at Level 4 with measurable KPIs and KRIs.

We’re a new fintech. Do we need the full CSF straight away?

New entrants and sandbox participants start with the Cyber Resilience Fundamental Requirements. They don’t replace the CSF, so full compliance is still expected after licensing. We plan both so you don’t redo work.

Does a penetration test count as SAMA red teaming?

No. SAMA treats red teaming as a separate, threat-intelligence-led exercise against your live environment. A penetration test is a useful step before it, not a substitute for it.

Can you help with our third-party and cloud providers?

Yes. SAMA expects its requirements to reach your outsourced vendors and cloud providers. We assess them and help you build those requirements into contracts and monitoring.

What happens after we reach Level 3?

SAMA expects maturity to be maintained and reviewed. We offer ongoing compliance monitoring and annual reassessments so your score doesn’t slip between reviews.

- Get In Touch

Let's Talk About Your SAMA Compliance Programme

If you need to know where your controls stand against SAMA before the regulator asks, talk to us. Reach out and get a straight answer on your maturity gap and what it will take to close it.

connect@awjtech.com

Phone

+971 55 232 9098

Head office

Office 55, Al Khaimah Building Port Saeed, Dubai, UAE

Response time

01 Business Day

Full Name*

Company*

Work email*

Phone*

WHERE WE CAN HELP YOU*

BRIEF US A BIT MORE

- Ready When You Are

Know Your SAMA Maturity Score
Before The Regulator Does

Most compliance programmes stall because nobody knows which gaps matter most. Start with a maturity assessment and get a ranked roadmap your team can act on the same week.