SAMA Compliance

Protect the Privacy of Government Data & Assests

SAMA Compliance

The Saudi Arabian Monetary Authority (SAMA) introduced the SAMA Cyber Security Framework to guide organizations in securing their critical information assets and online services. The move comes as part of the central bank’s efforts to enhance the sound practices in Financial Institutions and ensure compliance to the best standards in the industry. The purpose of establishing the Cyber Security Framework is to improve Cyber Resilience by adopting best practices. The SAMA Cyber Security Framework is a comprehensive framework comprising the best practices of various government frameworks and industry standards including NIST, PCI DSS, ISO 27001/27002, and Basel II. Implementing the Security Framework helps organizations in achieving a minimum level of security to manage and withstand the growing Cyber Security Threats. The Compliance Standard and Framework applies to all Financial Institutions regulated by SAMA who are also known as the Member Organization. This includes all banks, insurance companies, and finance companies that operate within Saudi Arabia.

Enquire

Free One Session of Consultation.

I agree to receiving further information about VISTA InfoSec and give consent to the handling of my information.

Our Approach to SAMA Compliance

Initial Study

We conduct an initial study of your business and understand your growth plans, current pain areas, and business goals. This will enable us to consolidate the Cloud scope thereby helping you reduce cost and time of rollout.

Scope Definition

Our team will help you identify and understand appropriate cloud platform models: IAAS, PAAS, SAAS, etc. We further support your management in Scope Definition which includes setting timelines, responsibilities, and budget for the implementation.

Data Flow Analysis

We identify all point of presence of your data in the Cloud and further map who accesses or can access your sensitive data. We also document the geographical distribution of your data.

Why work with VISTA InfoSec?

Vendor Neutral Solution- We provide a vendor-neutral assessment of your public/private/hybrid cloud options.
Industry Expertise- We will share industry-specific insight and provide relevant recommendations for achieving your goals of compliance.
Years of Experience- Your organization will benefit from our decade long years of Industry experience and knowledge.
Benchmark Standards- Using well-accepted benchmarks from CSA and NIST, we help organizations assess and secure their Cloud strategies.
International Frameworks- Using globally recommended frameworks from NIST, ENISA, CCM, we help organizations manage risks.
Robust Security & Risk Management Solution- Our state-of-the-art assessment framework effectively helps identify and mitigate infrastructure based risks on the cloud in context to insider access, ancillary data, software isolation, and availability.
Report Detailing the Analysis Finding- We will provide you documents detailing the findings of the analysis and provide relevant recommendations for the same.
Assessment & Certification- We also provide C-Star assessment and certification.
Strictly No Outsourcing- We value your trust in us so we do not outsource your critical assignments to another third party.

Frequently Asked Questions on SAMA Compliance

When is Cloud Risk Management required?

When your organization is making a significant Cloud-related change or transformation.
When your organization is creating a cloud strategy.
When your organization needs to determine your cloud readiness from the perspective of scalability, security or resilience.
When your organization is about to outsource or wishes to review outsource arrangements.
When regulators focus on you outsource arrangements and check the resilience of your critical services.
When the organization is looking to implement effective risk management of enterprise cloud services to achieve Industry Standard Compliance.
When your organization feels an appropriate level of service is not being provided by the cloud provider.

Do we provide an assessment against CCM?

Yes, we do provide an assessment against CCM. The Service milestone includes Gap Analysis, Advisory Services and even Final Attestation services.

Do we provide an assessment against ISO27017?

Yes. We provide our expertise and assess your organization to the requirements of ISO/IEC 27017. We assess the gap between the company declaration of cloud security and the actual implementation. Our assessment includes identifying the areas of concerns in cloud security, areas of improvement, and remediation measures.

What will be the output of Cloud Risk Management Service?

Cloud Risk Management Service involves Assessing, Identifying, and Managing risks related to cloud computing. It is performed to prevent the identified risks from impacting business goals. The output your organization can expect from the services includes-

Highlights the competency of existing Security and Privacy frameworks.
Identified risk exposure in the outsourced Cloud Computing Services.
Prioritize the identified risks based on their criticality and impact on business.
Implementation of suggested risk remediation.
Risk mitigation and improved security controls and frameworks.

How is scoping done for Cloud Assessment?

Our team of experts will first help you identify and understand appropriate cloud platform models: IAAS, PAAS, SAAS, etc. We then provide all the necessary support to your management in Scope Definition which includes identifying and prioritizing assets and risk, setting timelines, responsibilities, and budget for the implementation of remediation for identified risks.

How often do I need to do Cloud Risk Assessment?

Companies should review their Cloud Risk Assessments and Cloud Risk Management practices every 3 years, or whenever there are any significant changes to the workplace, security controls, policies, and processes.

What is the validity of the reports?

Any audit report is typically valid for a period of 1 year further to which a minimal yearly Compliance audit is required. Its advisable to go in for an assessment cycle every year or after significant change in processes.

How does Cloud Risk Management Benefits You?

Cloud Risk Management helps identify risks and level of risk exposure of your organizations.
It helps assess, and prioritize risks depending on the criticality.
The process facilitates the decision-making allocation of the budget for risk mitigation.
The risk management process facilitates focused remediation.
Gives direction to the organization for improving security.
Helps address issues and concerns of using a cloud environment.

How much will Cloud Risk Management Cost?

Cloud Risk Management will cost $8000.