# SAMA CSF Maturity Assessment: The Four Evidence Tiers That Distinguish Level 2 from Level 3 in Domain 4 (Threat Intelligence)
When preparing for a SAMA CSF maturity assessment, most institutions discover that Domain 4—Threat Intelligence and Cyber Defense—exposes a persistent gap between policy and practice. Organizations routinely subscribe to commercial threat feeds, attend sector briefings, and maintain vendor relationships. Yet when assessors ask for evidence that intelligence drives detection, hunting, and response decisions, the trail goes cold.
The difference between Level 2 and Level 3 maturity is not volume of feeds or frequency of briefings. It is the ability to demonstrate a closed loop: intelligence consumed, enriched, operationalized in controls, and validated through incident attribution. This article identifies the four evidence categories that assessors verify when scoring Domain 4 maturity, explains why each tier matters, and describes the artifacts that distinguish reactive collection from proactive hunting.
Why Domain 4 Maturity Stalls at Level 2
The Saudi Central Bank's Cyber Security Framework requires regulated institutions to establish and maintain threat intelligence capabilities appropriate to their risk profile. Domain 4 controls address the collection, analysis, sharing, and operationalization of threat information relevant to the financial sector.
At Level 2, institutions typically demonstrate:
- Active subscriptions to one or more commercial threat feeds
- Participation in sector information-sharing forums
- Documented procedures for receiving and reviewing intelligence bulletins
- Evidence of occasional threat briefings to technical teams
These activities satisfy the baseline requirement to collect threat intelligence. They do not, however, prove that intelligence shapes defensive posture, informs detection engineering, or accelerates incident response. Assessors scoring Level 3 and above look for evidence that intelligence flows into operational decisions and that the organization can trace defensive improvements back to specific intelligence inputs.
The plateau occurs because institutions treat threat intelligence as an information product rather than an operational input. Feeds arrive, analysts read summaries, and the cycle repeats without measurable change to detection rules, hunting priorities, or control configurations.
The Four Evidence Tiers Assessors Verify
Advancing from Level 2 to Level 3 requires assembling a defensible evidence trail across four tiers. Each tier answers a specific question that assessors pose during maturity reviews.
Tier One: Feed Subscription and Ingestion Records
Assessor question: What sources of threat intelligence does the institution consume, and can you prove continuous ingestion?
At this tier, evidence includes:
- Active subscription agreements or licenses for commercial threat feeds, showing coverage of financial-sector threats, regional adversaries, and technical indicators
- Configuration exports from SIEM, threat intelligence platforms, or security orchestration tools demonstrating automated ingestion of feeds
- Logs showing feed update frequency, record counts, and ingestion timestamps over a representative period (typically 90 days)
- Documentation of manual intelligence sources: sector working groups, regulatory circulars, vendor advisories
This tier establishes that intelligence enters the environment. It does not yet prove that anyone acts on it. Institutions with strong Tier One evidence but weak subsequent tiers remain at Level 2.
Tier Two: Enrichment and Contextualization Workflows
Assessor question: How does the institution determine which intelligence is relevant, and who makes that determination?
Evidence at this tier demonstrates analytical judgment applied to raw feeds:
- Documented workflows describing how analysts triage incoming indicators, assess relevance to the institution's technology stack and threat profile, and assign priority
- Enrichment records showing analysts appending context—such as asset inventory matches, vulnerability scan correlation, or threat actor attribution—to raw indicators
- Case management or ticketing records linking specific intelligence items to follow-up tasks: validation tests, control reviews, or hunting hypotheses
- Meeting minutes or decision logs where intelligence findings inform security architecture or investment decisions
Tier Two evidence shows that intelligence is not simply stored but evaluated for applicability. Institutions that can produce enrichment workflows but cannot demonstrate downstream action typically score mid-Level 2.
Tier Three: Detection-Rule Changesets and Control Updates
Assessor question: Can you show that threat intelligence directly resulted in new or updated detective and preventive controls?
This is the tier where most institutions falter. Evidence includes:
- Version-controlled detection rules (SIEM correlation rules, IDS/IPS signatures, EDR behavioral rules) with commit messages or change tickets explicitly referencing the intelligence that prompted the update
- Firewall, proxy, or DNS filtering rule additions citing specific indicators of compromise from threat feeds
- Vulnerability scan policy updates or patch prioritization decisions documented as responses to threat intelligence about active exploitation
- Threat hunting playbooks or queries developed in response to campaign reporting or sector alerts
The key attribute is traceability: an assessor should be able to select a threat intelligence report from the past quarter and trace it forward to a specific control change, or select a recent detection rule and trace it backward to the intelligence that justified it. Institutions that maintain this bidirectional traceability demonstrate Level 3 operationalization.
Tier Four: Incident Attribution and Validation Logs
Assessor question: When incidents occur, does the institution use threat intelligence to attribute, scope, and validate remediation?
The highest tier of evidence proves that intelligence closes the loop during and after incidents:
- Incident response reports that cite threat intelligence sources when attributing tactics, techniques, or threat actors
- Forensic analysis linking observed indicators to known campaigns or adversary infrastructure documented in threat feeds
- Post-incident reviews that reference intelligence to validate whether detective controls performed as expected or require tuning
- Metrics showing mean time to attribute or mean time to contextualize incidents, demonstrating that intelligence accelerates response
Tier Four evidence is less about volume and more about narrative coherence. A single well-documented incident that shows intelligence guiding attribution, scoping, and lessons learned carries more weight than dozens of incidents with no intelligence integration.
Common Evidence Gaps and How Assessors Interpret Them
Even institutions with mature security operations often present incomplete evidence chains. Recognizing these gaps early allows remediation before formal assessment.
Gap: Threat feeds ingested but no record of who reviews them or how often. Assessor interpretation: Intelligence collection exists on paper but may not be operationalized. Likely Level 2 ceiling.
Gap: Analysts produce enrichment reports, but no mechanism links those reports to detection engineering or hunting teams. Assessor interpretation: Analysis occurs in a silo. Intelligence does not influence defensive posture. Mid-Level 2.
Gap: Detection rules updated regularly, but change documentation does not reference intelligence sources. Assessor interpretation: Rules may be reactive (post-incident) rather than proactive (intelligence-driven). Difficult to distinguish from Level 2.
Gap: Incident reports mention threat actors or campaigns, but do not cite the intelligence sources used for attribution. Assessor interpretation: Attribution may be anecdotal rather than evidence-based. Tier Four evidence missing.
Building the Evidence Trail Before Assessment
Organizations preparing for a SAMA CSF maturity assessment should audit their current evidence posture across all four tiers. The exercise is straightforward:
- Inventory intelligence sources and confirm that subscription records, ingestion logs, and configuration exports are accessible and current.
- Review enrichment processes and ensure that analytical work—tagging, prioritization, asset correlation—is documented in a system of record, not email threads or analyst notebooks.
- Audit recent detection-rule changes and verify that commit messages, change tickets, or design documents reference the intelligence that prompted each update. Retrofit documentation where it is missing.
- Examine incident reports from the past 12 months and assess whether threat intelligence informed attribution, scoping, or validation. If not, establish a template or checklist that prompts responders to consult and cite intelligence sources.
The goal is not to fabricate evidence but to surface and organize the intelligence-driven work that already occurs informally. Many institutions perform Tier Three and Tier Four activities but fail to document them in a way that assessors can verify.
What a Defensible Level 3 Position Looks Like
An institution with defensible Level 3 maturity in Domain 4 can, within a working day, produce:
- A list of active threat intelligence sources and proof of continuous ingestion over the past quarter
- Examples of enriched intelligence items with documented relevance assessments and assigned priorities
- At least three recent detection-rule or control updates explicitly tied to threat intelligence, with version control or change tickets as evidence
- At least one incident report that cites threat intelligence for attribution or validation
The evidence is organized, indexed, and cross-referenced. An assessor can select any control update and trace it back to the intelligence that justified it, or select any intelligence report and trace it forward to the operational changes it prompted.
This is not a theoretical standard. It is the threshold that separates institutions demonstrating reactive collection from those demonstrating proactive operationalization.
How CISO Consulting Supports Domain 4 Maturity and Evidence Preparation
Organizations seeking to advance Domain 4 maturity or prepare for formal assessment engage CISO Consulting for maturity assessment, gap remediation, and evidence preparation against the SAMA Cyber Security Framework. The engagement delivers an evidence-based maturity rating for every control, with gaps prioritized by risk, effort, and regulatory weight.
The process includes practical remediation support, not just a report, and produces an evidence pack organized for reviewers. Deliverables include a maturity assessment report by domain and control, gap analysis and prioritized remediation roadmap, updated policies, standards and procedures, evidence pack and index, and an executive summary for the board.
Assessment typically requires 6–10 weeks; remediation proceeds as planned based on the roadmap and the institution's capacity. The firm works from the current published framework and any circulars that apply to the institution at the time of the engagement, ensuring alignment with the latest regulatory expectations.
The result is a defensible position ready for follow-up and re-assessment, with the evidence trail that distinguishes Level 2 collection from Level 3 operationalization already in place.
