When a Saudi financial institution sets out to build or refresh its SAMA CSF cybersecurity strategy, the first question is often where to start. Domain 1 (Cybersecurity Governance) and Domain 2 (Cybersecurity Risk Management) contain dozens of controls, and many CISOs treat them all as a single list to be implemented. The result is a document that mixes high-level governance principles with tactical project plans, confusing the board and frustrating the delivery team.
The distinction matters. A cybersecurity strategy defines direction: what you will protect, how much risk you will accept, who is accountable, and what success looks like. A roadmap translates that direction into sequenced initiatives, budgets, and timelines. The Saudi Central Bank (SAMA) Cybersecurity Framework expects both, but only when you separate them clearly can you produce a plan that is both compliant and executable.
This article explains which SAMA CSF Domain 1 and Domain 2 controls belong in your strategic layer and which translate into your multi-year roadmap, so your board approves a plan that moves forward.
Why the Confusion Happens
SAMA CSF Domain 1 and Domain 2 are written as control requirements, not planning guidance. Each control states what must be in place, not whether it is a governance decision or a technical project. A CISO reading Domain 1 sees controls on roles, policies, risk appetite, and reporting. Domain 2 adds risk assessment, treatment, monitoring, and third-party management. All are mandatory, all are interrelated, and none carry a label that says "strategy" or "roadmap."
The confusion deepens when institutions try to build a single document that satisfies both the board and the implementation team. Boards want clarity on objectives, accountability, and investment. Delivery teams need prioritized initiatives, dependencies, and budgets. When both are mixed into one plan, the board sees too much detail and the team sees too little direction.
The practical consequence is a plan that sits approved but unexecuted, or a roadmap that proceeds without strategic alignment, leading to compliance gaps and wasted investment.
The Strategic Layer: What Defines Direction
Your cybersecurity strategy is the governance foundation. It answers the questions that only senior leadership and the board can answer: what are we protecting, how much risk will we accept, who decides, and how will we measure success? SAMA CSF Domain 1 and parts of Domain 2 establish these requirements.
Domain 1 Controls That Belong in Strategy
Cybersecurity governance structure defines accountability. SAMA requires a clear allocation of cybersecurity responsibilities at board and executive level, including the establishment of a cybersecurity committee or equivalent oversight body. This is not a project; it is a strategic decision about who owns cybersecurity risk and how the institution will govern it. Your strategy document must name the governance structure, the reporting lines, and the decision-making authority.
Risk appetite and tolerance set boundaries. SAMA expects institutions to define how much cybersecurity risk they are willing to accept in pursuit of business objectives. This is a board-level statement, expressed in qualitative or quantitative terms, that guides every subsequent decision about controls, investments, and incident response. It belongs in the strategy, not the roadmap.
Policies and standards framework establishes the rule set. SAMA requires a comprehensive set of cybersecurity policies approved by senior management and reviewed regularly. The strategy defines which policies will exist, their scope, and the approval cycle. The roadmap schedules their development or refresh.
Roles and responsibilities clarify who does what. Domain 1 requires institutions to document cybersecurity roles, segregate duties, and ensure adequate resources. The strategic layer defines the target operating model: what functions will be in-house, what will be outsourced, and what skills are required. The roadmap then schedules recruitment, training, or service procurement.
Reporting and metrics define success. SAMA expects regular reporting to the board on cybersecurity posture, incidents, and compliance. The strategy specifies what will be reported, how often, and to whom. It defines the key performance indicators (KPIs) and key risk indicators (KRIs) that will measure progress. The roadmap schedules the implementation of dashboards and reporting tools.
Domain 2 Controls That Belong in Strategy
Risk management methodology sets the approach. SAMA requires institutions to establish a cybersecurity risk management process aligned with enterprise risk management. The strategy defines the methodology: how risks will be identified, assessed, treated, and monitored. It does not list every risk or every control; it sets the framework.
Risk treatment principles guide investment. Domain 2 requires institutions to decide how identified risks will be treated: accept, mitigate, transfer, or avoid. The strategy establishes the principles and thresholds for these decisions, aligned with risk appetite. Individual risk treatment plans belong in the roadmap.
Third-party risk management framework defines the boundaries. SAMA expects institutions to manage cybersecurity risks introduced by third parties, including cloud providers, outsourcers, and vendors. The strategy defines the governance model for third-party risk: what categories of vendor require assessment, what standards they must meet, and who approves exceptions. The roadmap schedules vendor assessments and contract reviews.
The Roadmap Layer: What Translates Into Projects
Your multi-year roadmap is the execution plan. It takes the strategic direction and breaks it into costed, sequenced initiatives that the organization can deliver. This is where the remaining SAMA CSF controls, and the detailed requirements within Domain 1 and 2, become projects with budgets, owners, and timelines.
Domain 1 Controls That Belong in the Roadmap
Policy development and refresh is a series of deliverables. Once the strategy defines the policy framework, the roadmap schedules the writing, approval, and communication of each policy. It assigns ownership, estimates effort, and sequences the work based on regulatory priority and business impact.
Training and awareness programs are recurring initiatives. SAMA requires regular cybersecurity training for all staff and specialized training for technical roles. The roadmap schedules the design, delivery, and measurement of these programs, with budget estimates for platforms, content, and external trainers if required.
Governance process implementation is a change program. Establishing the board committee, defining reporting cycles, and embedding decision-making processes are initiatives that require stakeholder engagement, documentation, and communication. The roadmap schedules these activities and assigns accountability.
Domain 2 Controls That Belong in the Roadmap
Risk assessment execution is a recurring project. The strategy defines the methodology; the roadmap schedules the first comprehensive risk assessment, follow-up assessments, and the resources required. It includes the cost of tools, workshops, and external expertise if the institution lacks internal capacity.
Control implementation is the bulk of the roadmap. Once risks are identified and treatment decisions made, the roadmap translates them into specific initiatives: deploying endpoint protection, implementing privileged access management, segmenting networks, or establishing a security operations center. Each initiative has a business case, a budget, dependencies, and a timeline.
Third-party assessments are scheduled activities. The roadmap lists which vendors will be assessed, when, and by whom. It includes the cost of questionnaires, audits, and remediation if gaps are found.
Monitoring and reporting tools are technology projects. The strategy defines what will be measured; the roadmap schedules the procurement, configuration, and integration of SIEM platforms, dashboards, and reporting tools.
How to Separate Strategy from Roadmap in Practice
Start with the business context. Interview leadership to understand business priorities, growth plans, and existing risk appetite. Review the current regulatory position and any outstanding SAMA findings. This context determines which strategic decisions are urgent and which roadmap initiatives deliver the most value.
Conduct a maturity baseline. Assess the current state of Domain 1 and Domain 2 controls against SAMA CSF requirements. This baseline identifies gaps that require strategic decisions (for example, no defined risk appetite) and gaps that require projects (for example, no asset inventory).
Draft the strategy first. Document the governance structure, risk appetite, target operating model, and success metrics. Test this with the board and executive leadership. Only when the strategic direction is agreed should you move to the roadmap.
Build the roadmap from the strategy. Translate strategic objectives into costed initiatives. Sequence them based on regulatory priority, risk reduction, and dependency. Estimate budgets using vendor quotes, internal resource costs, and contingency. Present the roadmap as a multi-year plan with annual review points.
Define measures that connect both layers. KPIs track delivery of roadmap initiatives; KRIs track whether the strategy is achieving its risk objectives. Both should be reported to the board in a single dashboard.
Common Gaps and How to Address Them
No documented risk appetite. Many institutions have never formally defined how much cybersecurity risk they will accept. Without this, every control decision is subjective and every roadmap is arbitrary. The solution is a board-facilitated workshop that translates business risk appetite into cybersecurity thresholds.
Strategy written by technical teams. When the CISO drafts the strategy without board input, it becomes a technical document that leadership does not own. The solution is to involve executive stakeholders early, frame cybersecurity in business terms, and secure board approval before detailed planning begins.
Roadmap without costs. A list of initiatives without budget estimates cannot be approved or executed. The solution is to cost each initiative, even if estimates are high-level, and to prioritize based on available budget and risk reduction.
No linkage between strategy and roadmap. When the two documents are developed separately, initiatives proceed without strategic alignment. The solution is to map each roadmap initiative to a strategic objective and to review the roadmap annually against strategic progress.
How We Help Institutions Build Both Layers
We translate business priorities, regulatory obligations, and the threat landscape into a costed, prioritized cybersecurity strategy and multi-year roadmap.
The process begins with understanding: interviews with leadership, review of the business plan, risk appetite, and regulatory position. We then assess maturity against SAMA CSF and the current threat picture. Next, we design objectives, initiatives, sequencing, and investment, tested with stakeholders. Finally, we prepare a board-ready strategy, roadmap, and measures, presented and adjusted for approval.
Deliverables include a cybersecurity strategy document, a three-year roadmap with budget estimates, a target operating model, a board presentation pack, and KPI and KRI dashboard definitions. The engagement runs six to ten weeks.
The approach includes a current-state and maturity baseline, business and regulatory alignment, threat and risk-informed priorities, a costed multi-year initiative roadmap, and KPIs and KRIs for the board. SAMA CSF and NCA ECC obligations that apply to the institution are built into the objectives and the roadmap, so compliance and security move together. We recommend a light annual review and a full refresh every three years, or sooner after a major change in the business or the regulatory landscape.
Closing: A Plan the Board Approves and the Team Delivers
Separating strategy from roadmap is not an academic exercise. It is the difference between a plan that sits in a drawer and one that moves the institution forward. When your board understands the direction, the risk appetite, and the investment required, approval follows. When your delivery team has a sequenced, costed roadmap aligned to that direction, execution follows.
If your institution is building or refreshing its cybersecurity plan, the distinction between strategic governance and tactical projects is where clarity begins. We help Saudi financial institutions produce both layers, so the board approves a plan that is compliant, executable, and aligned to the business.
