Which SAMA CSF Controls Are Actually Tested in a Ransomware Attack?
Compliance assessments verify that policies exist, that roles are documented, and that processes are written down. A ransomware incident reveals whether those SAMA CSF ransomware controls actually function under pressure—whether backups restore, whether the crisis committee convenes in minutes rather than hours, and whether communication channels remain open when primary systems are encrypted.
The gap between compliance on paper and operational resilience under attack is where many Saudi financial institutions discover their true readiness. This article maps eleven SAMA Cyber Security Framework controls that are stress-tested in every ransomware event, showing which weaknesses appear only when the incident is live.
The Difference Between Assessment and Reality
During a compliance assessment, an institution demonstrates that backup procedures are documented, that an incident response plan exists, and that business continuity arrangements are in place. Evidence is collected through interviews, policy reviews, and samples of recent activities. The assessment produces a maturity score and a gap register.
A ransomware attack tests whether those same controls deliver the outcomes they promise. Backups are not merely scheduled; they must restore encrypted databases within recovery time objectives. The incident response plan is not simply approved; it must guide decisions when legal, technical, and communications teams are working simultaneously under time pressure. Business continuity is not a document; it is the ability to maintain critical services while primary infrastructure is offline.
The controls that appear adequate during assessment often reveal specific, operational gaps during a live incident. Understanding which SAMA CSF controls are truly tested by ransomware helps CISOs and risk managers focus readiness efforts on the mechanisms that matter most when an attack occurs.
Eleven SAMA CSF Controls Tested by Ransomware
1. Backup and Recovery Integrity
The Saudi Central Bank requires financial institutions to maintain secure, tested backups of critical systems and data. During assessment, this control is satisfied by backup schedules, offsite storage arrangements, and records of periodic restore tests.
During a ransomware incident, the test is whether backups are offline and immutable—isolated from the network so that ransomware cannot encrypt them—and whether restoration completes within the recovery time objective for each critical system. Institutions discover whether backup verification was thorough, whether all dependencies were captured, and whether restore procedures work when multiple systems must be rebuilt simultaneously.
Gaps that appear only during the incident include incomplete application-layer backups, credentials stored in systems that are now encrypted, and restore procedures that assume infrastructure components which are themselves compromised.
2. Incident Detection and Alerting
SAMA CSF requires institutions to detect and respond to cybersecurity incidents promptly. Assessment reviews the security operations capability, the tools in place, and the escalation matrix.
Ransomware tests whether detection identifies the attack before widespread encryption, whether alerts reach the incident response team immediately, and whether the team can distinguish ransomware activity from normal system behavior during the critical first minutes. Institutions learn whether their detection rules cover lateral movement, whether logging is comprehensive enough to reconstruct the attack path, and whether the security operations center can operate effectively when some monitoring tools are themselves affected.
3. Incident Response Activation
The framework mandates a documented incident response plan with defined roles, communication paths, and decision authorities. During assessment, the plan is reviewed for completeness and evidence of tabletop exercises is examined.
A live ransomware event tests whether the plan activates smoothly—whether the incident manager is reachable, whether the response team assembles quickly, and whether each member understands their role without needing to consult the document. Institutions discover whether contact lists are current, whether decision thresholds are clear, and whether the plan accounts for scenarios where the incident commander or key technical staff are unavailable.
4. Containment and Isolation
SAMA requires institutions to contain incidents to prevent further damage. Assessment confirms that network segmentation exists and that procedures for isolation are documented.
Ransomware tests whether segmentation actually limits the spread of encryption, whether isolation can be executed quickly without causing unintended service disruption, and whether the institution can identify which segments are affected and which remain clean. The incident reveals whether network diagrams are accurate, whether isolation procedures work for cloud and hybrid environments, and whether the technical team can execute containment under pressure.
5. Forensic Preservation
The framework requires institutions to preserve evidence for investigation and regulatory reporting. During assessment, this is demonstrated through evidence-handling procedures and chain-of-custody documentation.
A ransomware attack tests whether forensic images can be captured before systems are rebuilt, whether logs are preserved in a tamper-proof manner, and whether the institution can maintain forensic integrity while simultaneously working to restore services. Institutions learn whether they have sufficient forensic storage, whether the team knows which artifacts are most valuable, and whether evidence collection can proceed in parallel with recovery.
6. Crisis Communication
SAMA CSF mandates clear communication during incidents, both internally and with regulators. Assessment reviews communication plans, templates, and records of past notifications.
During a ransomware incident, the test is whether the crisis communication team can draft accurate updates quickly, whether the institution notifies SAMA within required timeframes, whether internal stakeholders receive consistent information, and whether customer communication is timely and clear. Gaps appear when communication channels depend on systems that are encrypted, when approval workflows are too slow for the pace of the incident, or when messaging is inconsistent across different audiences.
7. Business Continuity Activation
The framework requires institutions to maintain and test business continuity plans for critical services. Assessment examines the plans, recovery time objectives, and records of annual tests.
Ransomware tests whether critical services can actually continue or resume within the stated objectives, whether manual workarounds function as designed, whether staff know how to execute continuity procedures, and whether dependencies on encrypted systems were fully understood. Institutions discover whether continuity plans account for the loss of multiple systems simultaneously, whether alternate processing sites are genuinely ready, and whether customer-facing services can operate during extended recovery.
8. Access Control Under Duress
SAMA requires institutions to enforce least privilege and to manage access rights carefully. During assessment, this is verified through access reviews, role definitions, and provisioning records.
A ransomware attack tests whether emergency access can be granted quickly to recovery teams, whether privileged credentials remain secure when identity systems are affected, and whether the institution can prevent unauthorized access during the chaos of response. The incident reveals whether emergency access procedures are documented, whether break-glass accounts are protected, and whether access logging continues to function.
9. Third-Party Coordination
The framework mandates management of third-party cybersecurity risks and requires institutions to coordinate with service providers during incidents. Assessment reviews contracts, service-level agreements, and evidence of third-party oversight.
Ransomware tests whether third-party vendors respond within contractual timeframes, whether coordination mechanisms work under pressure, whether the institution can access third-party systems needed for recovery, and whether vendors provide the support that agreements promise. Institutions learn whether incident response clauses are enforceable, whether vendors have their own recovery capabilities, and whether communication with multiple vendors can be managed effectively.
10. Regulatory Reporting
SAMA requires institutions to report significant cybersecurity incidents promptly and accurately. Assessment confirms that reporting procedures exist and that staff understand the requirements.
A live ransomware event tests whether the institution can gather the information SAMA requires while the incident is still unfolding, whether reporting happens within the required timeframe despite competing priorities, and whether updates are accurate and complete. Gaps appear when the team is unsure what constitutes a reportable incident, when information needed for the report is not readily available, or when the reporting process has not been practiced under realistic conditions.
11. Post-Incident Review
The framework requires institutions to learn from incidents and to improve controls based on lessons identified. During assessment, this is demonstrated through records of past reviews and evidence that findings led to remediation.
After ransomware, the test is whether the institution conducts a thorough post-incident review, whether lessons are documented clearly, whether root causes are identified, and whether improvements are implemented rather than merely recommended. Institutions discover whether the review process is structured, whether it involves all relevant stakeholders, and whether there is accountability for implementing changes.
Why Gaps Appear Only During Live Incidents
Several factors explain why controls that satisfy compliance assessments fail during ransomware attacks.
Complexity under pressure. Procedures that work during a scheduled test become difficult to execute when multiple systems are failing, when time pressure is intense, and when the team is managing stress and fatigue.
Undocumented dependencies. Assessments review documented architecture and stated dependencies. Ransomware exposes the informal dependencies, the undocumented integrations, and the assumptions that were never written down.
Simultaneous failures. Compliance tests typically examine one control or one system at a time. Ransomware affects many systems simultaneously, revealing interactions and conflicts that do not appear in isolated tests.
Communication breakdown. Assessment assumes that communication channels function. Ransomware often encrypts email, collaboration platforms, and documentation repositories, forcing the team to rely on channels that were never formally tested.
Decision-making under uncertainty. Procedures documented during calm assessment assume clear information and time to consult. Ransomware forces decisions with incomplete information, conflicting signals, and urgent time constraints.
Strengthening Controls Before the Test
Institutions that want to know whether their SAMA CSF ransomware controls will function during a real attack can take several steps before an incident occurs.
Conduct realistic exercises. Tabletop exercises that simulate the pressure, complexity, and communication challenges of ransomware reveal gaps that document reviews cannot. Exercises should include simultaneous system failures, unavailable key personnel, and communication channel loss.
Test backups under realistic conditions. Restore tests should simulate the loss of primary infrastructure, the unavailability of certain credentials, and the need to rebuild multiple interdependent systems simultaneously. The test should measure whether recovery completes within stated objectives.
Validate third-party arrangements. Contact vendors and confirm that incident response clauses are understood, that support will be available, and that communication channels are established. Test these channels before an incident.
Review and update documentation. Ensure that network diagrams, system dependencies, contact lists, and recovery procedures are current. Verify that documentation is accessible even if primary systems are encrypted.
Assess control effectiveness, not just existence. Move beyond verifying that policies and procedures exist. Test whether they deliver the outcomes they promise under realistic conditions.
A comprehensive gap assessment against SAMA CSF provides a structured way to evaluate where controls exist, where documentation is incomplete, and where testing has not been thorough. The assessment identifies which controls would benefit from deeper validation and which procedures should be tested under more realistic conditions.
Moving from Compliance to Resilience
Compliance with SAMA CSF is necessary but not sufficient. Resilience requires that controls function under the specific pressures of a ransomware attack—time urgency, simultaneous failures, communication breakdown, and decision-making under uncertainty.
Understanding which controls are truly tested by ransomware allows CISOs and risk managers to focus readiness efforts on operational effectiveness rather than documentary completeness. It shifts the question from "Do we have a backup policy?" to "Will our backups restore critical systems within recovery time objectives when primary infrastructure is encrypted?"
Institutions that assess their controls with this operational lens—testing not just for existence but for performance under pressure—build resilience that matters when the incident is live.
Evaluate Your Readiness Through Structured Assessment
A compliance assessment provides a clear, evidence-based view of where your institution stands against SAMA Cyber Security Framework requirements and where operational gaps may exist. The assessment includes control-by-control assessment, evidence testing and sampling, and maturity scoring by domain. The process follows four stages: scope definition of frameworks, entities and systems in scope; collection through questionnaire, interviews and evidence; assessment through control testing and maturity scoring; and reporting of findings, roadmap and presentation to management. Deliverables include an assessment report and maturity scores, a gap register with evidence, a remediation roadmap, and a board and management summary. The assessment typically requires 4–8 weeks and covers SAMA CSF, NCA ECC, PDPL, and SAMA CRFR. The result is a prioritized remediation plan that identifies which controls require deeper operational validation and which gaps should be addressed before the next incident tests your readiness in earnest.
