Key Takeaways
- SAMA expects Level 3 maturity at minimum: controls that are implemented and actively monitored against documented policy, not just written down.
- Identity and access management, logging, and continuous monitoring are the three controls most teams can start operationalizing right now, without a platform overhaul.
- Logging is the evidence layer that makes every other control auditable, so centralization and integrity matter as much as collection.
- Continuous monitoring under SAMA isn’t a one-time setup. The framework expects the monitoring process itself to be periodically evaluated for effectiveness.
- Secure.com’s GRC, Cloud Security, SOC, and Red AI Teammates map directly onto these three controls, each valuable standalone and governed by scope, permissions, and approvals your team sets.
Saudi financial institutions under the SAMA Cybersecurity Framework aren’t short on requirements. They’re short on hands to prove those requirements are actually being met, every day, with evidence that holds up in an audit. Three controls tend to sit at the top of that list: identity and access management, logging, and continuous monitoring. Here’s what SAMA actually asks for in each, and what “operationalized” looks like in practice.
Written policy isn’t the bar. Proven, monitored control is.
SAMA’s six maturity levels reward evidence over paperwork. Most member organizations stall below the line that actually counts for an audit.
Access is restricted on a need-to-know, need-to-have basis, so every user carries exactly enough privilege, and no more.
A defined, approved process logs and analyzes security events and responds to them, and that process itself gets checked for effectiveness.
What SAMA CSF Actually Asks For
The SAMA Cybersecurity Framework, maintained by the Saudi Central Bank, sets a common cybersecurity standard for banks, insurers, and financial institutions operating in the Kingdom. Member organizations self-assess against six maturity levels, and the expectation is to reach at least Level 3: cybersecurity controls that are implemented and actively monitored against documented policies, standards, and procedures.
Three controls your team can start operationalizing today
No platform overhaul required. These are the controls audits check first, and the ones most fintech teams can move on immediately.
Identity & Access Management
The easiest control to check, and the easiest to fail.
- Access mapped to real business need, not standing privilege
- Enforcement at the point of access, not just a policy doc
- Denied and failed attempts recorded, not just successful logons
- Privileged and remote access held to a tighter standard
Logging
The evidence layer underneath every other control.
- Access and system events centralized, not scattered
- Detailed enough to reconstruct who did what, when
- Retention and integrity controls that keep records trustworthy
- A defined path into SIEM or reporting, not manual exports
Continuous Monitoring
Where “we have a policy” becomes “we can prove it works.”
- Real-time analysis of security events, not end-of-month review
- Alerting tuned to abnormal behavior, not fixed thresholds
- A documented response step for every triggered alert
- The monitoring process itself gets tested and improved
That word, “monitored,” is where a lot of programs stall. Writing a policy is straightforward. Proving, continuously, that the policy is enforced and that evidence exists for every access decision and every security event is the harder, ongoing operational lift.
Two domains carry most of that weight:
- Identity and access control: member organizations should restrict access to information assets based on need-to-know or need-to-have, so only authorized users get sufficient (and no more than sufficient) access privileges.
- Cyber security event management: member organizations should define, approve, and run a process to log and analyze security events and respond to them, with that process periodically evaluated for effectiveness.
The Three Controls You Can Operationalize Today
1. Identity and Access Management
This is the control most audits start with, because it’s the easiest to check and the easiest to fail.
To operationalize it, your team needs to be able to show, on demand:
- Access policies mapped to actual business need, not standing privilege
- Enforcement at the point of access, not just a policy document in a shared drive
- A complete record of denied and failed access attempts, not just successful logons
- Evidence that privileged and remote access are held to a tighter standard than standard user access
2. Logging
Logging is the evidence layer underneath every other SAMA control. If it isn’t centralized, timestamped, and tamper resistant, it won’t hold up when an auditor asks for it.
Logging is the evidence layer under every other control
If it isn’t centralized, timestamped, and tamper-resistant, it won’t hold up when an auditor asks for it.
Log Store
Retention + integrity controls keep the record trustworthy and reconstructable.
Operationalizing logging means:
- Access and system events captured centrally, not scattered across point tools
- Logs detailed enough to reconstruct what happened, by whom, and when
- Retention and integrity controls that keep the record trustworthy
- A defined path for feeding logs into a SIEM or reporting workflow, not a manual export process
3. Continuous Monitoring
Monitoring is where “we have a policy” turns into “we can prove the policy works.” SAMA’s event management domain expects a process that’s not just documented but periodically evaluated for how well it actually catches and responds to anomalies.
In practice, that means:
- Real-time analysis of security events, not end-of-month review
- Alerting tuned to abnormal behavior, not just rule-based thresholds
- A documented response step for every alert that gets triggered
- Evidence that the monitoring process itself is being tested and improved, not left static
Where the loop lands on SAMA’s three controls
Each AI Teammate is complete and valuable on its own, you don’t need the full roster to start closing gaps.
Where Governed Defense, Powered by Offense Fits
Security work is growing faster than most teams can absorb, and SAMA’s three controls above are exactly the kind of work that piles up: policy evidence to collect, logs to review, alerts to triage, tests to rerun. Secure.com’s answer to that isn’t more headcount. It’s AI Teammates that execute real work inside boundaries your team sets, scope, permissions, approvals, and an audit trail, while a Red AI Teammate attacks the environment first so the evidence of what’s actually exploitable drives what gets hardened next.
Governed Defense, Powered by Offense. No More Grunt Work. No More Burnout. AI teammates attack your defenses, harden what they find, and hand your team back hundreds of hours a month. Your team sets the rules. AI teammates do the work. Attack. Harden. Prove. Repeat.
That loop runs in five steps:
- Attack: the Red AI Teammate simulates real adversary behavior, only within approved scope.
- Validate: confirms what’s actually exploitable, not theoretical risk.
- Harden: defensive teammates fix it, whether that’s a config change, control improvement, detection, or remediation.
- Prove: retests, records before and after, and keeps the approval trail as evidence.
- Repeat: feeds results back into future prioritization.
The teammate that attacks teaches the teammate that defends.
Mapping the Loop to SAMA’s Controls
You don’t need the full roster to start. Each AI Teammate is complete and valuable on its own, and your team keeps authority over every action it takes.
The GRC AI Teammate handles the ongoing evidence collection, keeping controls, compliance posture, and audit readiness current, while the Cloud Security AI Teammate flags misconfigurations and access drift in infrastructure before they become a finding.
Strengthened by the SOC AI Teammate, which owns alert triage, investigation, and case management, and by Security OS, the shared foundation behind every AI Teammate that provides the context, orchestration, and audit trail underneath the whole system.
Where the Red AI Teammate earns its place: continuous pentesting and adversary emulation that test whether your monitoring and detection actually catch a real attempt, not just a simulated one on paper.
You don’t need the full roster to start. Whether that’s the GRC AI Teammate closing your evidence gap or the SOC AI Teammate cutting down alert backlog, these teammates augment the people you already have, not replace them.
From 18 Months to Audit-Ready: A Realistic SAMA CSF Roadmap for Fintech Startups
A phase-by-phase roadmap for fintech startups in Saudi Arabia, from gap assessment to Level 3 audit readiness.
Read the article ComplianceThe SAMA Controls You Can Operationalize Today: IAM, Logging, and Continuous Monitoring
How to operationalize SAMA’s IAM, logging, and continuous monitoring controls, and where governed AI teammates fit into the evidence trail.
Read the articleFAQs
What is the SAMA Cybersecurity Framework and who does it apply to?
What maturity level should we be targeting?
Does an AI Teammate replace our identity and access policy work?
Can we start with just one AI Teammate instead of the full platform?
Is Security OS something we buy separately?
Conclusion
SAMA’s identity and access management, logging, and continuous monitoring controls aren’t going away, and they aren’t going to get lighter as regulatory scrutiny on financial institutions increases. What can change is how much of that evidence-gathering work sits on your team’s plate. Secure.com provides governed AI security teammates that attack, harden, and prove defensive outcomes, above the stack you already own, with your team setting the rules and approving consequential action every step of the way.
