When CISOs and compliance officers at Saudi regulated entities search for what is security awareness training NCA SAMA frameworks require, they often find vendor brochures promising "full compliance" through a single annual video module. Yet during regulatory assessments, examiners from the National Cybersecurity Authority and the Saudi Central Bank routinely identify gaps in awareness programs that technically meet the letter of the control but fail to change behavior or address the institution's actual threat landscape.
The confusion stems from how the requirement is written. NCA ECC Control 3-3-1 mandates that organizations establish and maintain a security-awareness program, while SAMA's Cybersecurity Framework addresses training and awareness across Domain 9. Both frameworks describe training as an ongoing program, not a one-time event, but neither prescribes the exact delivery model. This leaves institutions to interpret what "awareness training" means in practice—and many default to the simplest interpretation that produces an audit trail.
This explainer defines the three program components that NCA and SAMA examiners distinguish from compliance tick-boxes, explains how each component supports different control objectives, and clarifies which delivery model meets both regulatory expectations and the cultural context of Saudi institutions.
The Regulatory Expectation: A Program, Not an Event
Both NCA ECC and SAMA CSF frame security awareness as a continuous program with measurable outcomes, not a single training event. The NCA's Essential Cybersecurity Controls require organizations to ensure that employees understand their security responsibilities and can recognize common threats. SAMA's framework similarly emphasizes that financial institutions must maintain an awareness program appropriate to the institution's risk profile and the sensitivity of data employees handle.
The key word in both frameworks is "program." A program implies planning, delivery, measurement and adjustment over time. It implies different content for different audiences. It implies verification that the training changed behavior, not just that employees clicked through slides.
Regulators verify this expectation in three ways during assessments. They review the awareness plan and calendar to confirm the program is ongoing. They examine training records to verify that content is tailored to roles and risks. They ask for metrics that demonstrate behavior change, not just completion rates.
Institutions that treat awareness training as a single annual video fail all three verification points. The program exists on paper, but it does not address the control objective: reducing the likelihood that employees will cause or fail to detect a security incident.
The Three Program Components Regulators Verify
When examiners assess an awareness program, they look for three distinct components, each serving a different purpose and audience. Understanding these components clarifies what "awareness training" means in the regulatory context and helps institutions design programs that meet both the letter and the intent of the requirement.
1. Role-Based Training Tailored to Job Functions and Data Access
The first component is training content that varies by role, job function and the sensitivity of data employees access. Generic awareness training—the same content for every employee—does not meet the regulatory expectation because it cannot address the specific risks each role presents.
A customer-service representative who handles personal financial information faces different threats and has different responsibilities than a database administrator who manages the systems that store that information. A branch manager who approves transactions has different security obligations than a developer who writes code for the institution's mobile application. Role-based training addresses these differences.
NCA ECC and SAMA CSF both recognize that employees with elevated privileges or access to sensitive data require more detailed and technical training. The frameworks also recognize that employees in customer-facing roles need training on social-engineering tactics, while technical staff need training on secure configuration and change management.
Role-based training is not simply adding a few extra slides for IT staff. It means designing separate training sessions for distinct roles, each covering the threats that role is most likely to encounter, the controls that role is responsible for operating, and the procedures that role must follow when an incident occurs.
Examiners verify role-based training by reviewing training records and asking how content differs across roles. They may interview employees in different departments to confirm that training addressed role-specific risks. Institutions that cannot demonstrate role-based content are cited for gaps in their awareness program, even if completion rates are high.
2. Simulated Phishing and Social-Engineering Exercises with Metrics
The second component is practical testing that measures whether employees can recognize and respond to real threats. This typically takes the form of simulated phishing campaigns and social-engineering exercises, followed by immediate remedial training for employees who fail the test.
Simulated phishing serves two purposes. First, it provides a metric that demonstrates behavior change over time. If the click rate on simulated phishing emails decreases from one quarter to the next, the institution has evidence that awareness training is working. Second, it identifies employees who need additional training before they encounter a real attack.
NCA and SAMA examiners look for evidence that the institution is testing employees, not just training them. They review metrics from simulated campaigns and ask how the institution uses those metrics to improve the program. They expect to see declining click rates or increasing report rates over time, and they expect to see a process for providing immediate feedback to employees who fail a simulation.
Institutions that conduct only classroom training or video modules, with no practical testing, cannot demonstrate that employees will recognize threats in their actual work environment. Examiners view this as a gap because the control objective—reducing the likelihood of successful social-engineering attacks—is not being measured or verified.
The exercises must also reflect the institution's actual threat landscape. Generic phishing simulations that mimic consumer scams do not prepare employees for the targeted attacks that Saudi financial institutions and critical infrastructure operators face. Effective simulations mimic the tactics, language and pretexts that real attackers use against the institution's sector.
3. Executive Briefings on Emerging Threats and Regulatory Changes
The third component is regular briefings for senior management and the board on emerging threats, incident trends and changes to the regulatory landscape. This component addresses a different control objective: ensuring that executives and board members understand the institution's cybersecurity posture well enough to make informed risk decisions and provide effective oversight.
SAMA's Cybersecurity Framework explicitly requires that boards receive regular briefings on cybersecurity risks. NCA ECC includes similar expectations in its governance controls. These briefings are not the same as the awareness training provided to employees. They focus on strategic risks, regulatory developments and the effectiveness of the institution's security program.
Executive briefings serve several purposes. They equip board members to ask informed questions during risk committee meetings. They ensure that senior management understands the business impact of emerging threats. They provide context for budget requests and resource allocation decisions. They demonstrate to regulators that the institution's leadership is engaged in cybersecurity governance.
Examiners verify this component by reviewing board minutes and asking board members what cybersecurity topics they have discussed in recent meetings. Institutions that cannot demonstrate regular executive engagement in cybersecurity are cited for governance gaps, even if employee training completion rates are high.
Why Many Saudi Institutions Default to the Simplest Model
Given that regulators verify three distinct program components, why do so many institutions default to a single annual video? The answer lies in how awareness programs are procured and managed.
In many organizations, security-awareness training is treated as an HR function, not a cybersecurity function. HR departments are accustomed to compliance training—anti-money-laundering, code of conduct, workplace safety—that follows a simple model: assign a module, track completion, collect signatures. When cybersecurity awareness is added to the compliance training catalog, it inherits the same model.
This approach produces an audit trail that appears to satisfy the regulatory requirement. Every employee has completed the training. Completion rates are high. Attestations are signed. But the program does not address the control objective because it does not change behavior, does not tailor content to roles and does not measure whether employees can recognize real threats.
The procurement process reinforces this model. When institutions issue tenders for awareness training, they often specify deliverables in terms of completion rates and certificates, not behavior change or risk reduction. Vendors respond with the simplest solution that meets the specification: a video module and a learning-management system that tracks clicks.
Cultural factors also play a role. In some Saudi institutions, there is discomfort with simulated phishing campaigns because they involve "tricking" employees. There is concern that executives will view practical testing as a lack of trust. These concerns are valid and must be addressed through careful communication about the purpose of testing, but they should not prevent the institution from implementing a program that meets regulatory expectations.
How to Design a Program That Meets Regulatory and Cultural Context
An effective awareness program for a Saudi regulated entity includes all three components—role-based training, simulated exercises and executive briefings—delivered in a way that fits the institution's culture and operational reality.
The program begins with an annual plan that maps training topics, simulation campaigns and executive briefings to the institution's risk profile and regulatory calendar. The plan identifies which roles require specialized training, which threats the institution faces most frequently and which regulatory changes will affect the institution in the coming year.
Role-based training sessions are designed for distinct audiences: customer-facing staff, technical teams, managers with approval authority and employees with access to sensitive data. Each session addresses the threats that role is most likely to encounter and the controls that role is responsible for operating. Sessions can be delivered on site or remotely, depending on the institution's preferences and the audience's location.
Simulated phishing campaigns are conducted quarterly, with scenarios tailored to the institution's sector and the tactics attackers use against similar organizations in the Kingdom. Employees who click on simulated phishing links receive immediate remedial training. Metrics are tracked over time to measure improvement and identify departments that need additional support.
Executive briefings are delivered to the board and senior management at least twice per year, covering emerging threats relevant to the institution's sector, incident trends in the Kingdom and changes to NCA and SAMA requirements. Briefings are designed to equip executives to ask informed questions and make risk decisions, not to provide technical training.
All materials are available in Arabic and English, recognizing that Saudi institutions employ staff with varying language preferences and that regulatory communications often occur in both languages.
How CISO Consulting Supports Awareness Programs
CISO Consulting designs and delivers awareness programs that meet NCA ECC and SAMA CSF requirements while fitting the cultural and operational context of Saudi regulated entities.
Programs built around your real risks address the threats your institution actually faces, not generic scenarios. Role-based training for technical teams covers the specific controls those teams are responsible for operating. Briefings that equip boards to ask the right questions focus on strategic risks and regulatory developments, not technical details.
Measured results you can report provide the metrics examiners expect to see: click rates on simulated phishing, completion rates by role and evidence of behavior change over time. Content in Arabic and English ensures that all employees can engage with the material in their preferred language.
Deliverables include an annual awareness plan and calendar, board and executive briefing, role-based training sessions, awareness metrics and reporting, and campaign materials. Programs can be structured as an annual engagement or delivered as individual sessions, depending on the institution's needs. Sessions can be delivered at your premises in Riyadh or elsewhere in the Kingdom, or remotely.
Closing: Moving Beyond Compliance Tick-Boxes
Security-awareness training under NCA ECC and SAMA CSF is not a single annual video. It is a program with three distinct components—role-based training, simulated exercises and executive briefings—each supporting different control objectives and verified separately by regulators.
Institutions that design awareness programs around these three components, rather than defaulting to the simplest compliance model, reduce their exposure to social-engineering attacks, equip their boards to provide effective oversight and demonstrate to regulators that their awareness program addresses the intent of the requirement, not just the letter.
If your institution is designing or procuring an awareness program to meet NCA or SAMA training requirements, CISO Consulting can help you build a program that meets regulatory expectations and changes behavior. For more information about the Cybersecurity Awareness & Training service, contact the firm to discuss your requirements.
