TECHNOLOGY ALLIANCES
Technologies we deploy for this service
01
What are the Cyber Resilience Fundamental Requirements?
SAMA’s Cyber Resilience Fundamental Requirements (CRFR) provide a foundational set of expectations intended for early-stage entities within their applicable scope. They focus on building core capability to prepare for, withstand, respond to and recover from cyber disruption. The word “fundamental” does not mean optional, nor does it make the requirements universally applicable; the entity must verify current scope and supervisory direction.
Cyber resilience connects security controls with continuity of important services. Prevention remains valuable, but no control can remove all risk. Organisations need to understand critical services, dependencies, disruption tolerances and decision paths, then prepare people and technology to maintain or restore priority operations. Business continuity management (BCM) therefore belongs in the resilience conversation alongside incident response and technical recovery.
A proportionate foundation can include accountable ownership, a risk picture, an asset and dependency view, baseline protection, incident coordination, recovery arrangements, exercises and lessons learned. The specific CRFR requirements and wording must be taken from the current official SAMA text. An advisory engagement can help organise evidence and improvements but does not confer approval or certification.
02
Who should consider CRFR?
Entities should confirm whether they meet the intended early-stage profile and are within the requirements’ formal scope. Applicability may be tied to supervisory status, activity or direction. Do not assume every new technology company, fintech or SAMA-regulated organisation is covered in the same way. Ask legal and compliance owners to document the determination and check current official sources.
Even where CRFR does not directly apply, its resilience topics may help a young organisation establish proportionate practices. Mature organisations may use foundational controls as a baseline but should not treat them as a substitute for broader obligations. Business, technology, security, risk, continuity and supplier owners should participate because disruption crosses functional boundaries.
03
How to build resilience foundations
Begin with service context: identify important customer and business services, supporting applications, data, people, facilities and third parties. Record dependencies and ownership, including cloud and shared services. Agree how impact and criticality are judged. This inventory supports both cyber risk prioritisation and business continuity planning.
Review governance and risk practices. Assign an accountable sponsor, escalation route and decision authority for incidents and recovery. Maintain a concise risk register that connects threats and weaknesses to services. Define practical protection measures for identity, access, configuration, endpoint and data, proportionate to the systems and current requirements.
Connect incident response with BCM and disaster recovery. Clarify who declares an incident, who communicates with stakeholders, how priority services are maintained, and which recovery sequence is approved. Plans should include manual workarounds where feasible, backup responsibilities, restoration dependencies and validation of recovered systems. Recovery objectives should be set by the organisation through business-impact analysis, not invented by an external assessor.
Exercise the plans with realistic scenarios, including a supplier outage, ransomware or loss of a critical platform where relevant. Record decisions, communications, timing and blockers. Improve plans after tests and incidents, and verify that contact lists, backups and access arrangements remain usable. Supplier contracts and assurance should support, not replace, the entity’s own continuity decisions.
04
Deliverables and indicative timeline
A scoped foundation review may provide an applicability note, service and dependency map, CRFR evidence checklist, resilience and BCM gap assessment, incident and recovery playbook observations, exercise plan and prioritised action roadmap. Implementation support may include workshops, continuity exercises and retesting, each separately agreed. Keep confidential operational details in approved channels.
A bounded diagnostic may take several weeks, while service mapping, supplier coordination and exercises can extend delivery. Duration depends on service complexity, evidence quality, stakeholder availability and whether plans need to be tested. Estimates are indicative and scope-dependent; completing a review is not a guarantee of resilience or regulatory acceptance.
05
Primary source
Consult the official Cyber Resilience Fundamental Requirements text to confirm scope: https://rulebook.sama.gov.sa/en/entiresection/3726 . It is intended for recently established early-stage financial-sector entities seeking the SAMA Regulatory Sandbox and/or a licence; confirm your entity-specific applicability. The text explains that CRFR is not a replacement for later applicable SAMA Cyber Security and Business Continuity frameworks.
STRAIGHT ANSWERS
Frequently asked questions
What does CRFR stand for?
CRFR means Cyber Resilience Fundamental Requirements. It is distinct from similarly abbreviated fraud requirements and should be referenced by its full name in governance records. Check the current SAMA Rulebook for the authoritative title, status, scope and text before using the requirements as assessment criteria.
Are the requirements intended for every SAMA-regulated organisation?
Do not assume universal application. The requirements are intended for early-stage entities within the formal scope specified by SAMA. Confirm whether the legal entity and activities meet that scope, including any supervisory direction. A foundational resilience review can still be useful voluntarily, but that does not make CRFR formally applicable.
Why include business continuity management?
Cyber incidents can interrupt services even when security controls are in place. BCM helps an organisation identify priority services, dependencies, response decisions and recovery arrangements. It should connect with incident response and technology recovery. Business owners set impact priorities and recovery objectives through their own analysis, not through generic assumed numbers.
Does a backup prove that recovery will work?
No. Backups are one dependency in recovery. Restoration must be tested, access protected, integrity checked and sequencing understood. Recovery also depends on people, credentials, platforms, suppliers and business validation. Exercises should document practical blockers and lead to improvements rather than relying on a backup status report alone.
Can JODOR certify CRFR compliance?
No. JODOR can provide scoped advisory and implementation support, but does not issue SAMA approval or certification and cannot guarantee a regulatory outcome. The organisation remains accountable for determining applicability, operating controls, accepting risk and making any formal submissions or attestations.