The SAMA CRFR Remediation Mistake That Extends Timelines by Six Months: Treating 'Partially Compliant' Findings as Lower Priority Than 'Non-Compliant'
After a SAMA Cyber and Technology Resilience Framework review, most institutions approach SAMA CRFR remediation prioritization by sorting findings into three buckets: non-compliant, partially compliant and compliant. The instinct is to tackle non-compliant findings first—they sound more urgent—and leave partially compliant controls for later, since something is already in place.
This sequencing mistake is responsible for remediation programs that stall midway, miss regulatory deadlines and require extensive rework. Partially compliant findings frequently conceal the most significant architectural gaps, and those gaps create dependencies that prevent closure of other findings rated as non-compliant. When institutions discover these dependencies six months into a program, they face a choice between resequencing the entire roadmap or submitting evidence packages that SAMA examiners will reject.
This article describes the common mistakes institutions make when prioritizing SAMA CRFR remediation work, explains why partially compliant findings deserve closer scrutiny than their rating suggests, and shows how to sequence remediation by control dependency rather than compliance rating.
Mistake One: Assuming Partial Compliance Means Half the Work Remains
The mistake: Institutions treat a partially compliant rating as a signal that a control is fifty percent complete and requires only incremental improvement to close the finding.
Why it extends timelines: SAMA examiners assign a partially compliant rating when some elements of a control exist but critical components are missing or ineffective. The missing components are often foundational—policy frameworks, governance structures, architectural decisions or enterprise-wide processes. Implementing these foundations typically requires more effort, more stakeholders and longer lead times than building a control from scratch within a defined scope.
A common example: an institution receives a partially compliant rating for access governance because it conducts periodic access reviews in some systems but lacks a centralized identity governance framework, has no formal joiner-mover-leaver process and does not enforce segregation of duties. The examiner acknowledges the access reviews but notes that without the underlying framework, the reviews cannot be effective or consistent. Closing this finding requires designing and implementing an enterprise identity program—a larger effort than many fully non-compliant findings that involve deploying a technical control in a single domain.
Do this instead: When you receive a partially compliant rating, read the examiner's narrative to identify what is missing, not what is present. Map the missing components to the control's dependencies—governance, process, technology and evidence. Estimate effort based on the scope of the gap, not the compliance rating. If the gap is architectural or enterprise-wide, treat the finding as a program dependency and sequence it early.
Mistake Two: Sequencing Remediation by Compliance Rating Alone
The mistake: Institutions build remediation roadmaps by listing all non-compliant findings first, then partially compliant findings, then observations. Within each group, they may sort by risk rating or regulatory domain, but the compliance rating remains the primary sequencing criterion.
Why it extends timelines: This approach ignores control dependencies. Many non-compliant findings cannot be closed until partially compliant findings in foundational domains are resolved. For example, an institution cannot demonstrate effective vulnerability management (often rated non-compliant) until it has an accurate and complete asset inventory (often rated partially compliant because some inventory exists but is incomplete or unreconciled). If the roadmap sequences vulnerability management ahead of asset inventory, the institution will spend months building scanning coverage and patch processes, only to discover during evidence review that it cannot prove completeness because the asset baseline is unreliable.
The result is rework, delayed closures and a remediation program that appears to make progress on paper but cannot produce evidence packages that satisfy the examiner.
Do this instead: Map control dependencies before you sequence remediation. Identify which controls serve as inputs to others—common examples include asset inventory, risk assessment, governance committees, policy frameworks and identity management. Sequence these foundational controls early in the roadmap, regardless of their compliance rating. For each finding, ask: what other controls must be in place before we can implement this one effectively and prove it with evidence?
Mistake Three: Underestimating the Evidence Maturity Gap in Partially Compliant Findings
The mistake: Institutions assume that because a control is partially compliant, some evidence already exists and can be supplemented to meet the examiner's standard.
Why it extends timelines: SAMA examiners evaluate evidence across a maturity spectrum: ad hoc, documented, implemented, measured and optimized. A partially compliant rating often means the institution has ad hoc or undocumented practices but lacks the evidence artifacts that demonstrate consistent, repeatable processes. Closing the finding requires not only formalizing the process but also producing several cycles of evidence—meeting minutes, risk registers, approval records, monitoring reports—that show the control operating over time.
This evidence gap is particularly acute in governance and risk management domains. An institution may have a cybersecurity steering committee (partially compliant) but lack terms of reference, attendance records, decision logs or evidence that the committee's recommendations are implemented. Closing the finding requires establishing governance documentation, running the committee according to the documented process, and producing at least two to three cycles of evidence before the examiner will accept closure. This timeline often exceeds the effort required to implement a technical control rated non-compliant.
Do this instead: For each partially compliant finding, identify the evidence artifacts the examiner expects to see and the number of cycles required to demonstrate maturity. If the control involves governance, risk assessment or periodic review, plan for at least two full cycles before you submit evidence for closure. Sequence these findings early in the roadmap so that evidence cycles can run in parallel with other remediation work.
Mistake Four: Treating Partially Compliant Findings in Governance Domains as Low Priority
The mistake: Institutions prioritize technical and operational controls over governance findings, reasoning that governance improvements are less visible to the business and less urgent than controls that directly reduce cyber risk.
Why it extends timelines: Governance findings—cybersecurity committees, risk assessment processes, policy frameworks, roles and responsibilities—are dependencies for nearly every other control domain. An institution cannot demonstrate effective risk management, incident response, third-party oversight or change management without the governance structures that define accountability, escalation and decision rights. When governance findings remain open, evidence packages for dependent controls are incomplete or unconvincing, and examiners defer closure until the governance gaps are addressed.
A typical scenario: an institution closes multiple technical findings and submits evidence packages, but the examiner notes that the institution has not demonstrated who is accountable for each control, how risks are escalated or how the board is informed. The examiner requests evidence of governance processes, and the institution realizes it must backfill governance documentation and re-submit evidence for controls it believed were closed.
Do this instead: Identify all governance findings—regardless of compliance rating—and sequence them in the first phase of the remediation roadmap. Establish committees, document terms of reference, define roles and responsibilities, and run at least one full cycle of governance meetings before you begin submitting evidence packages for operational or technical controls. Governance is not overhead; it is the foundation that makes other evidence credible.
Mistake Five: Failing to Reconcile Partially Compliant Findings Across Domains
The mistake: Institutions treat each finding as independent and assign remediation to the control owner named in the examiner's report, without analyzing how partially compliant findings in different domains relate to the same underlying gap.
Why it extends timelines: Partially compliant findings often point to the same architectural or process gap, expressed in different control domains. For example, an institution may receive partially compliant ratings for identity management, access reviews, privileged access and segregation of duties—all symptoms of the absence of a centralized identity governance framework. If each finding is remediated independently, the institution will implement point solutions that do not integrate, will duplicate effort and will still lack the enterprise framework the examiner expects to see.
Do this instead: After you receive the examiner's report, conduct a cross-domain analysis of all partially compliant findings. Group findings that share a common root cause—identity governance, asset management, risk assessment, policy framework—and design a single remediation initiative that addresses the cluster. Assign a program owner, not just individual control owners, and sequence the initiative as a dependency for all related findings.
How to Sequence SAMA CRFR Remediation by Control Dependency
The alternative to rating-based sequencing is dependency-based sequencing. This approach prioritizes controls based on how many other controls depend on them, regardless of compliance rating.
Step one: List all findings and map their dependencies. For each control, identify the inputs it requires from other controls—governance, process, data or technology.
Step two: Identify foundational controls—those that serve as dependencies for multiple other controls. Common examples include cybersecurity governance committees, enterprise risk assessment, asset inventory, identity governance and policy frameworks.
Step three: Sequence foundational controls in the first phase of the roadmap, even if they are rated partially compliant or observation. Ensure these controls are implemented and producing evidence before you begin remediation of dependent controls.
Step four: Group related findings into remediation initiatives. If multiple findings share a root cause, address them together rather than sequentially.
Step five: For each finding, estimate the number of evidence cycles required to demonstrate maturity. Sequence controls that require multiple cycles early in the roadmap so that evidence collection can run in parallel with other work.
Step six: Review the roadmap with control owners and governance committees to confirm that dependencies are realistic and that the sequence aligns with regulatory deadlines.
How We Support SAMA CRFR Remediation Programs
We run remediation programs for institutions that have completed a SAMA Cyber and Technology Resilience Framework assessment or regulatory review. We prioritize gaps by control dependency, regulatory deadline and effort; mobilize control owners and agree plans and governance; provide implementation support with weekly tracking; and review evidence before findings are formally closed.
The program includes a remediation roadmap, weekly status and RAID log, evidence packs per control, monthly steering committee reports and a closure report for the regulator. We work alongside internal teams—providing program discipline and specialist depth while your teams own and operate the controls. The engagement runs as a retainer over three to nine months, depending on the number of findings and the maturity of existing controls.
For institutions where partially compliant findings reveal gaps in identity governance or cybersecurity governance structures, we also provide targeted support to design or strengthen those foundational capabilities before broader remediation work begins.
If you are managing a SAMA CRFR remediation program and need support sequencing findings, coordinating control owners or building evidence packages that close findings, we can help.
