Compliance · SAMA CSF

Penetration testing for SAMA's Cyber Security Framework and the CRFR

If SAMA regulates you, or you are applying for a SAMA licence or a place in its regulatory sandbox, SAMA expects regular penetration tests of your customer and internet-facing services. We scope your test to SAMA's requirements, a tester confirms every finding and we map each one to the framework's domains and subdomains.

Message us on WhatsApp See our services

What SAMA asks for

SAMA sets out its penetration testing requirements in two documents: its Cyber Security Framework (CSF) and the Cyber Resilience Fundamental Requirements (CRFR).

Cyber security reviewCSF 3.2.4
“Customer and internet facing services should be subject to annual review and penetration tests.” The same subdomain asks you to record the results, issues and recommended actions, report them to the business owner and follow up until issues are addressed and critical risks are treated.
Change managementCSF 3.3.7
Security testing of changes should include penetration testing where it applies.
Penetration testingCRFR 3.2.6
“Entities should conduct penetration testing (PT) twice a year as a minimum or after major/critical change.” Control 3.2.5 adds periodic, comprehensive vulnerability assessment of your application and infrastructure layers.

SAMA says the CRFR does not replace its other frameworks. Once licensed, you must also meet the Cyber Security Framework and SAMA's other requirements.

Who it applies to

Cyber Security Framework: SAMA's rulebook lists it for the banking sector, the finance sector, payment systems and payment service providers, credit bureaus and the regulatory sandbox.
CRFR: financial institutions applying for a SAMA licence or intending to qualify for its regulatory sandbox, in sectors such as finance, payments and money exchange.

The framework can also reach you through a contract. Subdomain 3.4.1 asks SAMA-regulated institutions to set cyber security requirements in their contracts with vendors, test those requirements on a risk basis and keep the right to carry out periodic cyber security reviews and audits. If you sell software or services to a bank or a payment company, you may be asked for a recent penetration test report.

How we scope your test

The framework talks about customer and internet-facing services. In practice, that can include:

Customer portals and websites
Authentication, access control between customers, session handling and business logic such as transfers, payments and limits.
Our service: Web application penetration testing
Mobile banking, wallet and payment apps
The iOS and Android apps and the APIs behind them.
Our service: Mobile app penetration testing
APIs, including those your partners call
Broken object-level authorisation, mass assignment and missing rate limits.
Our service: API & cloud security assessment
Internet-facing infrastructure
Exposed hosts and services and your external perimeter.
Our service: Network & infrastructure testing

We agree with you which services are in scope, list them in the statement of work and your authorisation letter, and test only what is listed. Systems hosted by third parties, such as cloud platforms and payment gateways, are tested only where their policies allow it or with their permission.

What your compliance team receives

Our deliverables line up with what 3.2.4 asks for:

Results, issues and recommended actions recorded: a technical findings report with CVSS scores, evidence and reproduction steps, plus a remediation roadmap prioritised by risk and effort.
Results reported to the business owner: an executive summary in business terms and a readout session with your leadership.
Follow-up until issues are addressed: one retest of all confirmed findings within 90 days at no extra cost, then a closure letter recording the status of each finding.
Framework mapping: each finding mapped to the SAMA framework domains and subdomains it affects, in a format your compliance team can file as audit evidence.

Every deliverable comes in Arabic, English or both. We do not issue certifications or carry out official compliance assessments.

How often to test

Cyber Security Framework: at least once a year for customer and internet-facing services, and as part of security testing for major changes.
CRFR: at least twice a year, and after any major or critical change.

If you are moving from the sandbox to a licence, plan for both. Ask us for a schedule that matches your obligations.

Common questions

We are a fintech in SAMA's sandbox. Which rules apply?

While you are applying for a licence or qualifying for the sandbox, the CRFR applies, including penetration testing at least twice a year. SAMA says the CRFR does not replace its other frameworks, so after licensing you must also meet the Cyber Security Framework.

Does a penetration test make us compliant?

No single test does. The framework covers your whole cyber security programme, from governance to third parties. A penetration test is your evidence for 3.2.4 and supports other controls. We do not issue certifications or carry out official compliance assessments.

We are not regulated by SAMA, but we serve banks. Do we need this?

You may, through your contract. Under subdomain 3.4.1, banks set cyber security requirements for their vendors, test them on a risk basis and keep the right to review them. A recent penetration test report helps you answer those reviews.

Can you test our mobile app and APIs?

Yes. See mobile app penetration testing and web application penetration testing. We test the APIs your apps depend on as part of each.

Will testing disrupt our production systems?

We plan every test to avoid disruption. Before we start, we agree testing windows, request rates, stop conditions and an escalation contact, and you can pause or stop testing at any time. Destructive techniques are excluded unless you authorise them in writing. Our Testing Safety Policy sets out every safeguard.

Can the report be in Arabic?

Yes. You choose Arabic, English or both for every deliverable.