When a SAMA assessor asks to see evidence of how your institution uses threat intelligence, the conversation often stalls. The institution subscribes to one or more commercial feeds. Security teams receive alerts. Yet the assessor cannot find a documented trail showing how intelligence is contextualized to the institution's risk profile, integrated into security operations or used to inform control decisions. This gap between subscription and evidence is the most common shortfall encountered during SAMA CRFR threat intelligence evidence requirements reviews.
SAMA's Cyber Resilience and Fraud Risk framework expects regulated institutions to maintain situational awareness of threats relevant to their operations, to integrate intelligence into risk assessments and security controls, and to demonstrate that intelligence informs decision-making. The framework does not prescribe specific feeds or platforms, but it does require evidence that intelligence is consumed, contextualized and acted upon. Most institutions meet the first requirement—they subscribe—but fail the second and third.
This article identifies the three evidence gaps SAMA assessors flag most often during compliance gap analyses, explains why generic threat feeds alone do not satisfy Domain 4 evidence requirements, and describes the documentary trail that closes each gap.
The Difference Between Subscription and Evidence
A commercial threat-intelligence subscription delivers indicators of compromise, vulnerability disclosures, campaign reports and actor profiles. These are valuable inputs. But SAMA assessors do not evaluate the quality of your feed provider. They evaluate whether your institution can demonstrate that intelligence is relevant to your environment, that it reaches the people who need it, and that it influences security decisions.
The distinction matters. A feed that arrives daily but sits unread in an inbox, or that generates alerts no one investigates, or that never appears in a risk register or control-change log, provides no evidence of an intelligence capability. The assessor is looking for a documented process that begins with collection, continues through analysis and contextualization, and ends with action or a reasoned decision not to act.
Most institutions discover this gap only when an assessor asks to see the last three months of threat-intelligence reports prepared for the security team, or requests evidence that a specific control change was informed by threat intelligence, or inquires how intelligence about a recent campaign affecting the financial sector was evaluated for relevance to the institution. The inability to produce these records is the evidence gap.
Gap One: Absence of Sector-Specific Threat Contextualization
The first gap assessors identify is the absence of documented analysis that contextualizes generic threat intelligence to the institution's sector, geography, technology stack and risk profile. A global feed may report a ransomware campaign targeting healthcare providers in Europe, a phishing campaign using Arabic-language lures, or a vulnerability in a widely deployed banking platform. The institution's role is to evaluate which of these threats are relevant, why, and what the institution should do in response.
Without this contextualization step, the institution cannot demonstrate that it understands its threat landscape. The assessor will ask: How do you determine which threats matter to your institution? Who performs this analysis? How often? Where is it documented?
The evidence required to close this gap includes:
Periodic threat assessments that identify threats specific to the Saudi financial sector, the institution's customer base, its digital channels and its third-party dependencies. These assessments should reference intelligence sources, explain why certain threats are prioritized and document the reasoning behind risk ratings.
Contextualized intelligence reports prepared for internal stakeholders—security operations, risk management, senior leadership—that translate raw intelligence into institutional relevance. A report might state: "Campaign X targets institutions using Platform Y, which we deploy in our mobile banking application. We assess the likelihood of targeting as medium based on our customer profile and public exposure."
Records of intelligence review meetings where the security team evaluates new intelligence, discusses relevance and assigns follow-up actions. Meeting minutes, action logs or ticketing-system records provide evidence that intelligence is actively consumed.
The absence of these records signals to the assessor that intelligence is received but not analyzed. Subscription alone does not satisfy the requirement.
Gap Two: No Documented Process Linking Intelligence to Control Changes
The second gap is the inability to demonstrate that threat intelligence informs changes to security controls, configurations, monitoring rules or incident-response procedures. SAMA expects institutions to use intelligence to improve their defenses. If intelligence reveals a new attack technique, a vulnerable configuration or an emerging threat actor, the institution should evaluate whether existing controls are sufficient and, if not, take action.
Assessors look for a documented process that connects intelligence to control decisions. They will ask: Can you show me a control change that was made in response to threat intelligence? How do you decide when intelligence requires a control adjustment? Who approves these changes?
The evidence required includes:
A defined process that describes how intelligence findings are escalated, evaluated and, when necessary, translated into control changes. This process should specify roles, approval authorities and timelines. It may be documented in a threat-intelligence policy, a security-operations procedure or a governance framework.
Change records that reference threat intelligence as the driver. If a firewall rule is updated, a monitoring signature is added, a patch is prioritized or an incident-response playbook is revised, the change log or ticket should cite the intelligence report or finding that prompted the change.
Risk-acceptance records for intelligence findings that do not result in control changes. If the institution evaluates a threat and concludes that existing controls are adequate, or that the risk is outside appetite, or that mitigation is planned for a future phase, that decision should be documented and approved by the appropriate authority.
Without this linkage, the institution cannot demonstrate that intelligence has operational value. The assessor sees a feed and a control environment, but no evidence that one informs the other.
Gap Three: Missing Records of Threat-Intelligence Consumption by Security Teams
The third gap is the absence of records showing that security teams—particularly security operations, incident response and vulnerability management—regularly consume and act on threat intelligence. Intelligence that remains in a separate system, accessible only to a single analyst or team, does not contribute to institutional resilience if it never reaches the people responsible for detection, response and remediation.
Assessors will ask: How do you ensure that relevant intelligence reaches your security operations center? How do incident responders access intelligence during an investigation? How does vulnerability management prioritize patching based on threat context?
The evidence required includes:
Integration of intelligence into security tools and workflows. Indicators of compromise should be loaded into SIEM rules, endpoint-detection platforms or threat-hunting queries. Vulnerability intelligence should inform patch prioritization. Campaign reports should be available to incident responders during investigations. The institution should be able to demonstrate that intelligence is not siloed.
Logs or records of intelligence consumption. Security operations may maintain a log of intelligence reports reviewed, indicators investigated or hunting activities conducted based on intelligence. Incident-response reports may reference intelligence sources consulted during an investigation. Vulnerability-management records may show that a patch was prioritized because of active exploitation reported in threat intelligence.
Training and awareness activities that ensure security teams understand how to access and use intelligence. This may include onboarding documentation, periodic briefings or tabletop exercises that incorporate intelligence scenarios.
The absence of these records suggests that intelligence is collected but not operationalized. The assessor cannot verify that the institution's security teams are informed by the intelligence the institution claims to use.
Why Generic Threat Feeds Alone Do Not Satisfy Domain 4 Requirements
SAMA CRFR Domain 4 addresses cyber-resilience capabilities, including threat intelligence, vulnerability management, security monitoring and incident response. The framework expects institutions to maintain awareness of the threat landscape and to use that awareness to inform risk management and control decisions.
A generic threat feed—one that provides global intelligence without sector, geographic or institutional context—does not satisfy this requirement on its own. The feed is an input, not a capability. The capability is demonstrated by the institution's ability to analyze, contextualize, integrate and act on intelligence.
Assessors evaluate this capability by reviewing evidence of the three activities described above: contextualization, integration into control decisions and consumption by security teams. Institutions that cannot produce this evidence are found to have a gap, even if they subscribe to multiple high-quality feeds.
The Documentary Trail That Closes Each Gap
Closing these gaps requires the institution to establish and document a threat-intelligence process that covers the full lifecycle: collection, analysis, dissemination, integration and action. The process should specify:
- Sources: Which feeds, sharing communities, sector groups and internal sources the institution uses.
- Analysis: Who is responsible for contextualizing intelligence, how often analysis is performed and what format reports take.
- Dissemination: How intelligence is shared with security operations, risk management, incident response, vulnerability management and senior leadership.
- Integration: How intelligence informs control changes, monitoring rules, incident-response playbooks and risk assessments.
- Action and feedback: How the institution tracks actions taken in response to intelligence, measures effectiveness and refines the process.
Each step in this process should generate records: reports, meeting minutes, change logs, risk-acceptance forms, tool configurations, training materials. These records constitute the evidence trail the assessor will review.
Institutions that lack this process—or that have the process but do not document it—should address the gap before the next assessment cycle. The absence of evidence is treated as the absence of capability.
When to Seek a Compliance Assessment
Institutions preparing for a SAMA CRFR assessment, or those that have received findings related to threat intelligence in a prior review, should consider a compliance gap assessment to identify and remediate evidence gaps before the next regulatory review.
A compliance assessment evaluates the institution's current state against SAMA CRFR requirements, tests the availability and quality of evidence, and produces a prioritized remediation roadmap. For threat-intelligence gaps, the assessment will review the institution's intelligence sources, processes, documentation and integration with security operations, and will identify specific records or process steps that are missing.
The assessment follows a structured process: scope definition, evidence collection through questionnaires and interviews, control-by-control testing, maturity scoring by domain and delivery of findings with a remediation roadmap. The engagement typically requires four to eight weeks and produces an assessment report with maturity scores, a gap register with evidence references, a remediation roadmap and a board and management summary.
Institutions that complete a gap assessment before a regulatory review are better positioned to respond to assessor inquiries, to produce required evidence promptly and to demonstrate that gaps are understood and being addressed. The assessment also provides a baseline for measuring progress and for planning future improvements to the threat-intelligence capability.
Closing
If your institution subscribes to threat-intelligence feeds but cannot demonstrate how intelligence is contextualized, integrated into security operations or used to inform control decisions, you face the same evidence gaps SAMA assessors identify in most compliance reviews. Closing these gaps requires a documented process, regular analysis and a clear trail linking intelligence to action.
A compliance assessment identifies where your evidence falls short, tests the availability of records assessors will request and delivers a roadmap to close each gap before your next regulatory review.
