The Saudi Central Bank (SAMA) Cyber Security Framework mostly reads as a governance document. It covers leadership, risk management, operations, and third-party security, and describes each area in terms of principles, objectives, and control considerations. A bank’s security team has to go one step further and ask what those controls mean day to day.<\/p>\n
Many of the controls describe work that has to happen continuously: monitoring, centralized logging, incident handling, collecting evidence, and reporting. A written policy cannot show that this work is happening. Operational systems can, and in most banks the Security Information and Event Management (SIEM) platform<\/a><\/strong> is the main one.<\/p>\n This article connects SAMA cybersecurity framework SIEM expectations to things a bank can buy, configure, test, and demonstrate.<\/p>\n