SAMA IT Governance Framework — Board-Level Controls Banks Must Implement

Overview

The SAMA IT Governance Framework (ITGF v1.0) sits above the cybersecurity framework. ITGF is about how the board governs, oversees and invests in IT — including cybersecurity, business technology, digital transformation and IT financial management. It applies to the same set of member organisations as the CSF, with the same enforcement model: annual self-assessment, biennial independent assessment.

Who this applies to

• Every SAMA-licensed bank, finance company, insurance company and PSP.
• Board members of those organisations carry personal accountability for IT governance outcomes.

Three Lines of Defence

ITGF mandates an explicit three-lines model:

| Line | Owner | Function | |---|---|---| | 1st line | Business units + IT operations | Daily controls, first-level risk ownership | | 2nd line | Risk function + Compliance + Information Security | Policy, oversight, challenge | | 3rd line | Internal Audit | Independent assurance to the Audit Committee |

The CIO and CISO sit in different lines — never the same person.

Key board-level controls

ITGF defines 39 board-level controls. The high-impact ones:

1. IT Strategy approved by the board every 3 years, reviewed annually.
2. Annual IT plan aligned to corporate strategy with measurable KPIs.
3. IT investment governance — project portfolio reviewed quarterly.
4. Enterprise architecture function with a chief architect.
5. Vendor and outsourcing governance including concentration risk.
6. IT risk appetite explicitly set by the board.
7. Business continuity oversight tied to IT operations.
8. Talent strategy for IT and cyber retention.

Step 1: Establish IT governance committees

BOARD
 │
 ├── IT Strategy Committee (chaired by a non-executive director)
 │   - Quarterly meetings
 │   - Reviews strategy execution, major investments, vendor concentration
 │
 ├── Audit Committee
 │   - Receives internal audit IT reports
 │
 └── Risk Committee
     - Receives IT risk register, KRI dashboard

Step 2: IT strategy document

Mandatory contents:

• 3-year horizon with annual milestones.
• Linked to corporate strategy KPIs.
• Capacity plan (people, money, infrastructure).
• Technology bets identified and risk-rated.
• Approved exit / sunset list for legacy systems.

Step 3: Board KPIs

Sample minimum dashboard the board should review quarterly:

SAMA Board IT/Cyber Dashboard — Q1 2026

Strategic
  - % strategy milestones on track          : 87%
  - IT spend vs. budget                     : 96.4%
  - Cloud workloads vs. plan                : 71% of target

Risk
  - Open high IT risks                       : 4
  - Open critical cyber findings             : 1 (90-day SLA)

Operations
  - Service availability (T1 apps)           : 99.96%
  - Incidents > P2 in quarter                : 7
  - Patching SLA P1 compliance               : 98.1%
  - PAM coverage of privileged accounts      : 100%

People
  - IT/cyber turnover (rolling 12m)          : 14.2%
  - Open critical roles                      : 3

Step 4: IT investment governance

Quarterly portfolio review:

• Projects > SAR 1m approved at the IT Strategy Committee.
• Post-implementation review for every major project at month 6 and month 12.
• Benefits realisation tracked vs. business case.
• Programmes overrunning by > 20% trigger a board-level briefing.

Step 5: Vendor and concentration risk

Track:

• Top 10 vendors by spend.
• Number of critical services depending on each top vendor.
• Concentration risk thresholds (e.g., no single vendor > 30% of total spend on critical IT).
• Cloud concentration risk explicitly flagged.

Step 6: Independent assurance

Internal audit must:

• Maintain a 3-year audit plan covering all IT/cyber domains.
• Audit at least 25% of CSF/ITGF controls annually.
• Have direct reporting line to the Audit Committee.
• Be staffed with auditors who hold CISA / CRISC / equivalent.

Common gotchas

• Strategy approved by the CIO but not the board — fails immediately.
• IT portfolio meetings happen but no minutes — assessors will not accept verbal-only.
• KPI dashboard manually compiled in PowerPoint each quarter — auditors want a sustainable source.
• IT Audit reports go to the CIO before the Audit Committee — independence broken.

Verification

• Board-approved 3-year IT strategy + last review minutes.
• Quarterly IT Strategy Committee minutes for the past year.
• Annual IT plan signed by the board.
• Portfolio register with project status.
• Vendor concentration analysis dated within the last quarter.
• Internal Audit plan + at least four IT audit reports per year.

Conclusion

ITGF makes IT a board-level discipline. The board cannot delegate accountability; it can only delegate execution. Build the dashboards, hold the meetings, and document everything.

Related guides

• SAMA Cyber Security Framework — Full Roadmap
• SAMA Business Continuity Management
• SAMA Cloud Computing Rulebook