ISO 27001 Annex A Controls SAMA: Applicability for Banks
When Saudi financial institutions implement ISO 27001, the most consequential document is the Statement of Applicability. This single artefact records which of the 93 ISO 27001 Annex A controls SAMA-regulated entities will implement, which they exclude, and why. The Saudi Central Bank expects both the information security management system and the cyber security controls to align with the SAMA Cyber Security Framework, and auditors scrutinize the Statement of Applicability to confirm that every decision is defensible.
This article maps each Annex A control to SAMA Cyber Security Framework domains, explains the typical applicability decisions Saudi banks and payment service providers make, and shows how to document your reasoning so that both certification auditors and SAMA examiners accept it.
Understanding the Statement of Applicability
The Statement of Applicability is not a checklist. It is a formal record of risk treatment decisions. For each of the 93 controls in ISO 27001:2022 Annex A, the organization must state whether the control is applicable or not, provide justification for the decision, describe the implementation status, and reference the owner or procedure.
An applicable control is one that addresses a risk the organization has identified in its risk assessment. A control may be excluded because the risk does not exist in the organization's context, because the risk is treated by other means, or because the risk is accepted. The justification must be specific, not generic.
SAMA-regulated entities face additional scrutiny because the SAMA Cyber Security Framework prescribes mandatory controls across thirteen domains. When an Annex A control overlaps with a SAMA control, excluding it requires a clear explanation of how the SAMA requirement is met through alternative means.
Mapping Annex A to SAMA Cyber Security Framework Domains
The SAMA Cyber Security Framework organizes controls into domains: Cybersecurity Governance, Cybersecurity Defense, Cybersecurity Resilience, Third-Party Cybersecurity Service Provider Management, and others. Many Annex A controls correspond directly to SAMA requirements; some address gaps that SAMA does not explicitly cover; a few are redundant when SAMA controls are already implemented.
Organizational Controls (Annex A.5)
These 37 controls address governance, policies, roles, human resources, asset management, and supplier relationships. For Saudi banks, almost all are applicable.
A.5.1 Policies for information security maps to SAMA's Cybersecurity Governance domain. Every regulated entity maintains an information security policy approved by the board or senior management. Exclusion is not defensible.
A.5.2 Information security roles and responsibilities aligns with SAMA's requirement for a chief information security officer and defined accountability. Applicable for all institutions.
A.5.7 Threat intelligence corresponds to SAMA's emphasis on situational awareness and intelligence sharing. Banks typically apply this control and cite participation in the Financial Sector CERT or similar arrangements.
A.5.19 to A.5.24 cover supplier security. These controls map to SAMA's Third-Party Cybersecurity Service Provider Management domain. Given the regulatory focus on outsourcing risk, excluding any of these controls requires strong justification, such as demonstrating that the institution has no third-party service providers with access to sensitive data or systems—a rare situation.
A.5.30 ICT readiness for business continuity aligns with SAMA's Cybersecurity Resilience domain. Applicable for all institutions, as business continuity and disaster recovery are mandatory under SAMA rules.
People Controls (Annex A.6)
These eight controls address screening, terms of employment, awareness, disciplinary process, and responsibilities after employment ends.
A.6.1 Screening is almost always applicable. SAMA requires background checks for personnel with access to critical systems. Excluding this control would contradict regulatory expectations.
A.6.2 Terms and conditions of employment and A.6.3 Information security awareness, education and training map directly to SAMA's requirements for security awareness programs. Both are applicable.
A.6.4 Disciplinary process is typically applicable, though smaller institutions may justify exclusion if they rely on general HR disciplinary procedures that already address information security violations.
Physical Controls (Annex A.7)
These 14 controls address physical security, secure areas, equipment protection, and disposal.
A.7.1 Physical security perimeters and A.7.2 Physical entry correspond to SAMA's requirements for data center and office security. Applicable for institutions with on-premises infrastructure. Institutions that operate entirely in third-party cloud environments may exclude some physical controls, but must document that physical security is contractually required of the cloud provider and verified through audit reports.
A.7.4 Physical security monitoring is applicable for most banks, which maintain security operations centers or use surveillance in branches and data centers.
A.7.7 Clear desk and clear screen is often applicable, especially for institutions handling customer financial data at workstations. Exclusion is difficult to justify in a banking environment.
A.7.14 Secure disposal or re-use of equipment aligns with SAMA's data protection requirements. Applicable for all institutions.
Technological Controls (Annex A.8)
These 34 controls address endpoint security, access control, cryptography, logging, vulnerability management, and secure development.
A.8.1 User endpoint devices through A.8.5 Secure authentication are almost always applicable. SAMA's Cybersecurity Defense domain requires strong access controls, multi-factor authentication, and endpoint protection. Excluding these controls would directly conflict with SAMA requirements.
A.8.9 Configuration management and A.8.10 Information deletion map to SAMA's requirements for secure configuration baselines and data lifecycle management. Both are applicable.
A.8.16 Monitoring activities and A.8.17 Clock synchronization support SAMA's incident detection and response requirements. Applicable for all institutions.
A.8.19 Installation of software on operational systems is typically applicable. SAMA expects change control and software integrity verification.
A.8.23 Web filtering and A.8.24 Use of cryptography are applicable. SAMA requires cryptographic controls for data in transit and at rest, and web filtering is a standard defense measure.
A.8.28 Secure coding and A.8.29 Security testing in development and acceptance are applicable for institutions that develop applications in-house. Institutions that rely entirely on vendor software may exclude these controls, but must document that security testing is contractually required of vendors and verified.
Conclusion on Applicability Patterns
Across Saudi financial institutions, certain patterns emerge. Controls related to governance, access management, cryptography, logging, incident response, business continuity, and third-party risk are almost always applicable. Controls related to physical security may be partially excluded for cloud-native institutions, provided that contractual and audit evidence demonstrates equivalent protection. Controls related to secure development may be excluded if no in-house development occurs, but vendor security requirements must be documented.
The key is specificity. "Not applicable" is not sufficient justification. "Not applicable because the institution operates entirely in a public cloud environment, and physical security is contractually required of the cloud provider per Section 4.2 of the service agreement, verified through the provider's SOC 2 Type II report reviewed annually" is sufficient.
Documenting Applicability Decisions for Auditors
Auditors—both ISO 27001 certification bodies and SAMA examiners—expect to see a clear thread from risk assessment to Statement of Applicability to implemented controls.
For each applicable control, document:
- The specific risk or risks the control addresses, referencing the risk register
- The implementation status: fully implemented, partially implemented, or planned
- The owner: the role or department responsible
- The evidence: the policy, procedure, system configuration, or log that demonstrates the control is operating
For each excluded control, document:
- The reason: the risk does not exist, the risk is treated by other means, or the risk is accepted
- The justification: specific facts about the organization's context, technology, or business model
- Any compensating controls or alternative measures
- Approval: exclusions of controls that map to SAMA requirements should be reviewed by the chief information security officer and, for high-risk exclusions, by the risk committee
Auditors will challenge generic justifications. "Not relevant to our business" will prompt questions. "Not applicable because the institution does not develop software; all applications are procured from vendors, and security testing requirements are specified in Section 7.3 of the vendor management policy" will satisfy the auditor.
How We Support Statement of Applicability Development
When we implement an ISO/IEC 27001:2022 ISMS for a Saudi financial institution, the Statement of Applicability is a core deliverable. We begin with the risk assessment, identifying the information assets, threats, vulnerabilities, and existing controls. The risk register drives the applicability decisions: each control is evaluated against the identified risks and the SAMA Cyber Security Framework requirements.
We map each of the 93 Annex A controls to SAMA domains and document the typical applicability decision for the institution's profile—retail bank, payment service provider, or finance company. We draft the justification for each exclusion, ensuring it references specific facts about the institution's context, and we identify the evidence required for each applicable control.
The Statement of Applicability is reviewed with the information security manager and the chief information security officer, revised based on their input, and finalized as part of the ISMS manual. We then support the internal audit, which tests whether the applicable controls are operating as documented, and the management review, which confirms that the Statement of Applicability remains accurate as the organization's context changes.
Finally, we provide a certification readiness review before the stage 1 and stage 2 audits, ensuring that the Statement of Applicability, risk register, and evidence are aligned and complete.
The project duration is four to eight months, depending on the institution's size, complexity, and existing control maturity.
Closing
The Statement of Applicability is the bridge between risk assessment and control implementation. For Saudi financial institutions, it must satisfy both ISO 27001 certification auditors and SAMA examiners. Every inclusion and exclusion must be justified with reference to identified risks and regulatory requirements.
If you are preparing a Statement of Applicability for a SAMA-regulated entity and need support mapping Annex A controls to the SAMA Cyber Security Framework, our ISO/IEC 27001 ISMS Implementation service provides the risk assessment, Statement of Applicability, policies, internal audit, and certification readiness review your institution requires.
