SAMA ITGF Cybersecurity Committee Charter Checklist
SAMA ITGF Domain 2 requires regulated institutions to establish a board-level or executive cybersecurity committee with a documented charter, yet many institutions submit generic templates that fail examiner review. The Saudi Central Bank expects specific governance elements that demonstrate genuine oversight, not administrative formality. When examiners request evidence of board approval and review the charter itself, they verify nine mandatory clauses that determine whether your cybersecurity governance structure meets regulatory expectations.
This SAMA ITGF cybersecurity committee charter checklist identifies those nine clauses, explains why each matters to examiners, and provides the board-resolution wording that satisfies the approval requirement so your governance structure passes the first review.
Why Generic Committee Charters Fail SAMA Examiner Review
Most institutions begin with a template downloaded from the internet or borrowed from another organization. These documents typically include vague statements about "overseeing cybersecurity" and "meeting periodically," but they lack the operational specificity SAMA ITGF Domain 2 requires.
Examiners look for evidence that the committee can actually function—that it knows when to meet, who decides what, how urgent matters escalate, and what happens when members disagree or face conflicts. A charter that cannot answer these questions signals that the committee exists on paper only, which is precisely what the framework was designed to prevent.
The second common failure point is board approval. Many institutions present a charter signed by the committee chair or the CISO, but SAMA expects formal board or board-committee resolution that establishes the cybersecurity committee as a governance body with defined authority. Without that resolution, the charter is a working document, not a governance instrument.
The Nine Mandatory Clauses Examiners Verify
1. Mandate and Scope
What it is: A precise statement of what the committee is responsible for—cybersecurity strategy approval, risk appetite setting, incident oversight, investment decisions, or policy ratification.
Why it matters: Examiners verify that the mandate does not duplicate the audit committee, the risk committee, or management responsibilities. Overlapping mandates create accountability gaps. The clause should specify whether the committee approves, advises, or monitors, and for which cybersecurity domains.
Checklist item: Does the mandate clause list specific decision rights (approve strategy, set risk appetite, ratify policies) and distinguish these from management execution responsibilities?
2. Composition and Membership
What it is: The roles that must be represented—typically including board members or executive management, the CISO, the CIO, the CRO, and the head of internal audit as an observer.
Why it matters: SAMA ITGF expects independence from IT operations and representation from risk and compliance functions. Examiners check that the CISO is a member, not merely an attendee, and that the committee is not dominated by technology staff who report to the same executive.
Checklist item: Does the composition clause name roles (not individuals), specify whether the CISO is a voting member, and include at least one independent voice from risk or audit?
3. Quorum Requirements
What it is: The minimum number of members who must be present for the meeting to proceed and for decisions to be valid.
Why it matters: Without a quorum rule, a committee of seven can make binding decisions with two attendees. Examiners verify that quorum is set high enough to ensure diverse input—typically a majority of voting members or a minimum that includes the chair and the CISO.
Checklist item: Does the charter specify quorum as a number or percentage, and does it require the chair or deputy chair to be present?
4. Meeting Frequency and Scheduling
What it is: How often the committee meets under normal circumstances—monthly, quarterly, or another interval—and the notice period for scheduled and emergency meetings.
Why it matters: SAMA expects regular oversight, not ad hoc gatherings when an incident occurs. Examiners review meeting minutes to confirm the committee actually convenes at the stated frequency. The clause should also address emergency sessions for major incidents or breaches.
Checklist item: Does the charter specify ordinary meeting frequency (e.g., quarterly), the notice period (e.g., seven days), and the trigger for emergency meetings (e.g., material incident, regulatory deadline)?
5. Escalation Thresholds and Triggers
What it is: The criteria that require immediate notification to the committee or escalation to the full board—incident severity, risk-rating thresholds, budget overruns, regulatory deadlines, or third-party breaches.
Why it matters: This clause operationalizes oversight. Examiners verify that the committee is not waiting for quarterly reports when a critical incident has occurred. Clear thresholds ensure the CISO knows when to escalate and the committee knows when it must convene.
Checklist item: Does the charter define escalation triggers by impact (e.g., incidents affecting customer data, risks rated critical, vendor breaches), and does it specify the escalation timeframe (e.g., within 24 hours)?
6. Decision Authority and Voting
What it is: Which decisions require committee approval, which require board approval, and how votes are conducted and recorded—simple majority, unanimous consent, or chair casting vote in the event of a tie.
Why it matters: Ambiguity about authority creates delays and accountability gaps. Examiners verify that the charter distinguishes between decisions the committee can make (e.g., approve annual cybersecurity budget within approved limits) and those it must recommend to the board (e.g., risk appetite changes, major control exceptions).
Checklist item: Does the charter list decision categories, specify voting rules, and clarify which decisions are final and which are recommendations to the board?
7. Reporting Lines and Documentation
What it is: To whom the committee reports (the board, the board risk committee, the audit committee), what it reports (minutes, risk dashboards, incident summaries), and how often.
Why it matters: SAMA ITGF Domain 2 requires that cybersecurity risks and incidents reach the board. Examiners verify that the reporting line is documented and that minutes and reports are actually produced. The clause should also specify who prepares reports, who reviews them, and where they are stored.
Checklist item: Does the charter specify the recipient of committee reports, the reporting frequency (e.g., quarterly summary to the board), and the documentation standards (e.g., minutes approved within 14 days)?
8. Conflict-of-Interest Rules
What it is: The procedure when a committee member has a personal or business interest in a matter under discussion—disclosure requirements, recusal from voting, and the threshold that triggers the rule.
Why it matters: Cybersecurity committees often review vendor contracts, third-party assessments, and investment decisions where members may have indirect interests. Examiners verify that the charter includes a conflict mechanism, even if it has never been invoked.
Checklist item: Does the charter require members to declare conflicts at the start of each meeting, specify when a member must recuse, and state how the declaration is recorded in the minutes?
9. Annual Self-Assessment and Charter Review
What it is: A requirement that the committee reviews its own effectiveness and the charter itself at least annually, and recommends amendments to the board.
Why it matters: SAMA expects governance structures to mature. A charter that never changes signals a committee that is not learning. Examiners verify that the charter includes a review clause and that the institution can produce evidence of at least one review cycle.
Checklist item: Does the charter specify an annual self-assessment (e.g., effectiveness survey, terms-of-reference review) and require board approval for charter amendments?
The Board-Approval Evidence Examiners Request
A complete charter is not sufficient. SAMA examiners request evidence that the board formally approved the committee's establishment and its terms of reference. The following wording, adapted to your institution's governance structure, satisfies this requirement:
Board Resolution Template:
"The Board of [Institution Name], at its meeting held on [date], resolves to establish the Cybersecurity Committee as a committee of the Board [or: as an executive management committee reporting to the Board Risk Committee], with the terms of reference set out in the attached charter, effective [date]. The committee is authorized to exercise the decision rights specified in clause [X] of the charter, and shall report to the Board [or: to the Board Risk Committee] on a [quarterly] basis. The charter shall be reviewed annually, and any amendments require Board approval."
The resolution should appear in the board minutes, and the charter should be attached as an annex. If your institution's governance structure places the cybersecurity committee at executive management level rather than board level, the resolution should come from the board committee to which it reports (typically the board risk committee or the board audit committee), and the wording should clarify the reporting line.
Common Gaps That Delay Approval
Even when all nine clauses are present, examiners identify recurring gaps:
- Vague escalation triggers: "Material incidents" without defining materiality, or "significant risks" without a rating scale.
- No deputy chair: The charter specifies a chair but does not address who leads meetings in the chair's absence, creating quorum ambiguity.
- Undefined terms: References to "management" or "the risk function" without specifying roles, so accountability is unclear.
- No document control: The charter lacks a version number, approval date, or next review date, so examiners cannot verify it is current.
- Inconsistent terminology: The charter uses "cybersecurity" and "information security" interchangeably, or refers to "the committee" and "the forum" in different clauses, creating confusion about whether one or two bodies exist.
Address these gaps before submission. Examiners return incomplete charters for revision, which delays the overall SAMA ITGF assessment and signals weak governance maturity.
How We Help You Design and Approve a Charter That Passes Review
Our Cybersecurity Governance & Organization service designs or strengthens your cybersecurity governance—the function, its mandate, committees, roles and responsibilities, and how decisions reach the board, creating clear ownership, committees and reporting lines that regulators expect to see.
The engagement follows four stages. First, we review your current structure, mandates, committees and reporting. Second, we compare this with regulatory expectations and good practice to identify gaps. Third, we design the charter, committees, RACI and role descriptions that address those gaps. Fourth, we provide approval support, run the first committee cycle and hand over to your team.
Deliverables include a governance framework document, a cybersecurity function charter, committee charter and agenda templates, a RACI matrix, and an organization chart and role descriptions. The engagement typically runs four to six weeks.
We work with institutions regulated under SAMA CSF, NCA ECC and SAMA ITGF. If you are uncertain whether the CISO should report to the CIO, we address a common question: regulators in the Kingdom expect the cybersecurity function to be independent from IT operations, and we recommend the reporting line that satisfies this for your structure and size.
When your charter is complete and approved, your governance structure will pass examiner review, your committee will know when to meet and what to decide, and your board will receive the cybersecurity oversight SAMA ITGF Domain 2 requires.
