Institutions regulated by SAMA often treat cryptography as a one-time deployment task. In practice, the way keys and certificates are managed shapes what an auditor later finds in logging and monitoring. This article explains which SAMA CSF Domain 3 cryptographic controls a vCISO should validate before a key-management system goes live, and what certificate-lifecycle evidence keeps Domain 5 clean.
A note on references: the SAMA Cyber Security Framework organizes requirements into domains, and cryptography sits within the technology-focused controls of Domain 3, while logging and monitoring evidence is addressed under Domain 5. We describe the requirements by topic rather than by sub-control number, so map them to your own control register and the current framework text.
Why Domain 3 failures surface in Domain 5
A key-management system can be technically sound and still generate audit findings. The usual reason is that the lifecycle events of keys and certificates were never captured in a form an auditor can test. A certificate expires without a record of who owned it, a revocation cannot be tied to a ticket, or renewal timestamps sit in three different tools. The cryptographic design passes review, but the evidence fails.
Scoping the validation work before go-live, rather than after, is the practical remedy.
The five controls to validate
1. Algorithm selection
Confirm that approved algorithms and key lengths are documented in a cryptography standard, that weak or deprecated options are prohibited, and that the standard is applied to data at rest, in transit and in application-level signing. Validate that the key-management system cannot be configured outside this standard without an exception on record.
Usual gap: the standard exists, but legacy applications still negotiate older protocols and no exception register tracks them.
2. Key-generation entropy
Keys must come from a trustworthy source of randomness. Validate that generation happens inside the hardware or approved cryptographic module, not on general-purpose servers, and that the vendor's documentation of the random source is retained as evidence.
Usual gap: development and test keys generated in software are later promoted to production use.
3. Rotation schedules
Define rotation periods by key type and data sensitivity, and confirm the system enforces them rather than relying on calendar reminders. Validate the procedure for emergency rotation after suspected compromise, including who authorizes it.
Usual gap: a schedule is written in policy, but no key has actually been rotated, so the process is untested at audit.
4. HSM integration
Check that root and master keys are protected in a hardware security module, that administrative roles are separated, and that dual control applies to sensitive operations. Confirm that HSM administrative actions are forwarded to central logging, since this is the point where Domain 3 and Domain 5 meet.
Usual gap: HSM audit logs remain on the device and are never collected centrally.
5. Certificate-authority trust chains
Document the CA hierarchy, the protection of the offline root, the issuing CA's policy, and how trust anchors are distributed to endpoints. Validate that no unmanaged or self-signed certificates are trusted in production systems.
Usual gap: no authoritative inventory of certificates, so expiry is discovered by outage.
Certificate-lifecycle evidence for Domain 5
Domain 5 evidence requirements concern whether relevant events are logged, protected, retained and reviewed. For certificates, that means each lifecycle event should produce a record that can be tested. SAMA CSF does not prescribe one log format, so the layout below is a practical structure rather than a mandated one.
Each record should carry these fields:
- Event type: issuance, renewal or revocation
- Event timestamp in a single agreed time standard, synchronized across systems
- Certificate serial number and subject
- Issuing CA identifier
- Requesting owner and approving party
- Related change or ticket reference
- Validity start and end dates
- For revocation: reason code and the time the revocation was published
An issuance record, for example, would show the timestamp, serial number, subject, issuing CA, requester, approver and ticket reference. A renewal record should link back to the serial number it replaces. A revocation record should show both the decision time and the publication time, so the gap between them can be explained.
Beyond the format, auditors usually test three things: that logs are forwarded to central monitoring, that they are protected against alteration and retained for the agreed period, and that someone reviews expiry and revocation alerts. Keep evidence of that review, such as a dated sign-off or a ticket.
A sensible order of work
- Confirm the cryptography standard and exception register before configuring the platform.
- Build the certificate and key inventory, with a named owner for each item.
- Validate generation, HSM integration and role separation in a pre-production environment.
- Define the log fields above and connect the sources to central logging.
- Run a test cycle: issue, renew and revoke a certificate, then confirm every event appears in the log with correct timestamps.
- Rotate a key under the documented procedure and retain the record.
- Approve go-live only when the test evidence is filed.
What to ask a vCISO to deliver
If you are scoping virtual CISO coverage, write these validations into the engagement rather than assuming they are included. Ask for a go-live readiness review against the five controls, an agreed evidence list mapped to Domain 3 and Domain 5, and a named owner for each open gap.
CISO Consulting's vCISO Services provide strategic cybersecurity leadership on demand, with a dedicated Virtual CISO aligned to your business objectives. The service is built on SAMA CSF and NCA ECC, and its features include regulator and auditor liaison, vendor and budget oversight, and committee and board reporting. Those are the functions a key-management deployment needs, since it involves a vendor, a budget and an eventual audit.
The engagement begins with an assessment of posture, risks and quick wins in the first 30 days. A roadmap is then agreed with management, followed by ongoing leadership, committees and reporting. Deliverables include a security roadmap and priorities, a monthly management report, a quarterly board pack, and committee minutes with action tracking. Open cryptographic and logging gaps can be tracked through those same channels until they are closed.
Closing
Cryptographic controls are easiest to validate before go-live and hardest to defend afterwards without evidence. If you are planning a key-management deployment or deciding what a virtual CISO should cover, our vCISO Services team can help you set the scope and keep Domain 3 and Domain 5 aligned.
