# How We Build a Cybersecurity Governance Model in Four Phases: From SAMA ITGF Mandate Analysis to Board-Approved Committee Charter
Establishing SAMA ITGF cybersecurity governance that satisfies regulatory expectations is not a matter of copying templates. The Saudi Central Bank's IT Governance Framework requires financial institutions to demonstrate clear ownership, independent oversight, and documented decision-making structures. Yet many boards and executive committees face the same practical questions: Should the CISO report to the CRO, the CTO, or directly to the board? What committees are needed, and who sits on them? What authority does each role hold, and where does escalation stop?
We design or strengthen cybersecurity governance through a four-phase method that moves from regulatory analysis to board-approved documentation. At the end, the client holds a governance framework document, a cybersecurity function charter, committee terms of reference, role descriptions, and a decision-authority matrix—structures that internal audit and external examiners accept. This article walks through each phase, explaining what happens, who participates, and what you receive.
Phase One: Mandate and Regulatory-Requirement Mapping
The first phase establishes what SAMA ITGF and related frameworks require of your cybersecurity governance, then compares those requirements to your current arrangements. This is not a full compliance assessment; it is a targeted review of governance structures, reporting lines, and decision-making authority.
What Happens
We review your current organizational structure, the cybersecurity function's mandate (if one exists), any existing committee charters, and the reporting lines between the CISO, executive management, and the board. We examine how cybersecurity risks are escalated, who approves policies, and who owns incident-response decisions.
In parallel, we map SAMA ITGF requirements that govern the cybersecurity function's independence, the board's oversight responsibilities, and the need for documented roles and responsibilities. We also consider the NCA Essential Cybersecurity Controls where they touch governance, and any sector-specific guidance SAMA has issued.
Who Takes Part
On the client side, this phase involves the CISO or equivalent, the chief risk officer, the head of internal audit, and typically the chief operating officer or chief financial officer. We conduct short interviews—usually thirty to forty-five minutes each—and review existing documentation such as organization charts, committee minutes, and policy registers.
What You Hold at the End
You receive a gap summary that lists each governance requirement, describes your current state, and identifies what is missing or unclear. Common gaps include an undefined cybersecurity mandate, no formal committee for cybersecurity oversight, unclear escalation paths to the board, or a reporting line that places the CISO under the CIO without documented independence safeguards.
This summary becomes the blueprint for the design phase.
Phase Two: Function Sizing and Reporting-Line Design
The second phase answers a question that often stalls governance projects: where should the CISO sit in the organization, and to whom should the function report? SAMA ITGF expects the cybersecurity function to be independent from IT operations, but the right structure depends on the institution's size, complexity, and existing risk-management arrangements.
What Happens
We analyze the institution's risk profile, the volume and complexity of IT systems, the maturity of the risk function, and the board's current committee structure. We then propose reporting-line options—typically CISO reporting to the CRO, to the COO with a dotted line to the board risk committee, or in some cases directly to the CEO or board.
For each option, we document the independence safeguards, the escalation path for critical incidents, and how the arrangement satisfies SAMA's expectation that cybersecurity oversight is not subordinated to operational IT priorities. We also size the function: how many direct reports the CISO should have, which roles are essential (such as security operations, governance and compliance, and identity management), and which can be combined or outsourced.
Who Takes Part
This phase involves the CFO, COO, CRO, and often a board risk-committee member or the board secretary. We facilitate a working session—usually two hours—where we present the options, discuss the trade-offs, and reach consensus on the preferred model.
What You Hold at the End
You receive a proposed organization chart showing the cybersecurity function's place in the institution, the reporting line with independence rationale, and a high-level breakdown of roles within the function. You also receive a short narrative explaining why this structure satisfies SAMA ITGF independence requirements—a narrative that can be included in board papers or presented to examiners.
Phase Three: Committee Design and Decision-Authority Matrix
With the reporting line settled, the third phase designs the committees and decision-making structures that translate cybersecurity risk into board-level oversight. SAMA ITGF expects the board to receive regular cybersecurity reports and to approve key policies and risk-appetite statements. This phase defines how that happens.
What Happens
We design the committee structure. In most cases, this means drafting or revising the charter for a cybersecurity steering committee (or cybersecurity sub-committee of the executive risk committee) and defining its relationship to the board risk committee. The charter specifies membership, quorum, meeting frequency, agenda topics, escalation triggers, and decision authorities.
We also prepare a RACI matrix—Responsible, Accountable, Consulted, Informed—that maps key cybersecurity activities (policy approval, incident response, vendor risk acceptance, control-exception approval) to roles across the business, IT, security, risk, and internal audit. This matrix clarifies who decides, who executes, and who must be kept informed.
Finally, we draft role descriptions for the CISO and key security roles, specifying authorities, reporting obligations, and interfaces with other functions. These descriptions are concise—typically one to two pages—and written to satisfy both HR requirements and regulatory expectations.
Who Takes Part
The CISO, CRO, and COO participate in a design workshop (half a day) where we walk through draft charters and the RACI matrix. We refine the documents based on their input, then circulate them to internal audit and the board secretary for comment.
What You Hold at the End
You receive:
- A cybersecurity function charter that defines the function's mandate, scope, independence, and reporting obligations.
- A committee charter (or terms of reference) for the cybersecurity steering committee, including membership, quorum, agenda templates, and escalation criteria.
- A RACI matrix that assigns decision rights and responsibilities for cybersecurity activities across the institution.
- Role descriptions for the CISO and key security positions, aligned with the governance model.
These documents are in draft form, ready for executive review and board approval.
Phase Four: Board-Approval Package and Handover
The final phase prepares the governance model for board approval and ensures the new structures can operate without further consulting support.
What Happens
We assemble a board-approval package: a cover memo summarizing the governance model, the rationale for the chosen reporting line, and how the model satisfies SAMA ITGF requirements; the cybersecurity function charter; the committee charter; the organization chart; and the RACI matrix. The package is written for board members who may not be cybersecurity specialists but who must satisfy themselves that oversight is adequate.
We also prepare agenda templates for the first three meetings of the cybersecurity steering committee, pre-populating topics such as policy approval, risk-register review, and incident-reporting protocols. These templates give the committee a practical starting point.
Finally, we conduct a handover session with the CISO and the committee secretary, walking through the charters, explaining how to use the RACI matrix in practice, and answering questions about escalation scenarios.
Who Takes Part
The CFO or COO typically reviews the board package before it is submitted. The board secretary may request adjustments to align with the institution's board-paper format. The CISO and the designated committee secretary attend the handover session.
What You Hold at the End
You receive the complete governance framework document—a single consolidated reference that includes the function charter, committee charter, organization chart, role descriptions, and RACI matrix. You also receive the board-approval package and the agenda templates, ready for the first committee meeting.
The governance model is documented, approved, and operational.
Full List of Deliverables
Across the four phases, the engagement produces:
- Governance framework document
- Cybersecurity function charter
- Committee charter and agenda templates
- RACI matrix
- Organization chart and role descriptions
Each document is tailored to the institution's structure and written to satisfy both internal governance needs and regulatory expectations under SAMA ITGF.
Duration and What Comes Next
The engagement typically runs four to six weeks from kickoff to board submission, depending on the institution's size and the complexity of existing governance arrangements.
Once the governance model is approved, many institutions move to strengthen specific controls—such as identity and access governance, or to conduct a full compliance assessment against SAMA CSF or NCA ECC. Clear governance makes every subsequent project easier, because roles, responsibilities, and escalation paths are already defined.
If your institution is establishing or restructuring cybersecurity governance to meet SAMA ITGF requirements, and you need a documented model that auditors and examiners accept, our Cybersecurity Governance & Organization service delivers the charters, committees, and decision-authority structures that regulators expect to see.
