# SAMA CSF

Source: https://s3msecurity.com/compliance/sama-csf/
Last updated: 2026-11-12

S3M supports five sections of the SAMA Cyber Security Framework with technical controls. ConnGuard NAC discovers devices and enforces need-to-know access, CityGate and SpotGate segment the network and guest Wi-Fi, EndGuard checks BYOD devices, and SAMI and APNZone feed event management with access records and SIM alerts.

**SAMA Cyber Security Framework, version 1.0.** Applies to: Banks, insurers, financing companies and other organizations regulated by the Saudi Central Bank. Official text: https://rulebook.sama.gov.sa/en/cyber-security-framework-2

## How S3M supports it

| Article / control | What it asks | How S3M supports it | Products |
| --- | --- | --- | --- |
| 3.3.3 Asset Management | Keep an accurate, current register of information assets. | ConnGuard NAC discovers the devices on the network, which feeds the asset register. | ConnGuard NAC |
| 3.3.5 Identity and Access Management | Grant access on need-to-know and manage identities and access rights. | ConnGuard NAC and CityGate enforce need-to-know network access by identity and role. S3M does not provide multi-factor authentication. | ConnGuard NAC, CityGate |
| 3.3.8 Infrastructure Security | Secure the infrastructure, including network segmentation. | CityGate segments the network without VLANs, and SpotGate keeps guest Wi-Fi apart from internal systems. | CityGate, Spotgate |
| 3.3.10 Bring Your Own Device (BYOD) | Handle business use of personal devices securely. | ConnGuard NAC admits personal devices by identity and posture, and EndGuard binds each one to its user. Device management stays with your MDM. | ConnGuard NAC, EndGuard |
| 3.3.14 Cyber Security Event Management | Collect and monitor security events. | SAMI keeps audit-ready records of access events, and APNZone reports unauthorized SIMs, which feed your event monitoring. | SAMI, APNZone |

S3M supports these requirements with technical controls. This is not legal advice or a certification; confirm legal questions with your counsel.

Checked against the official text on 2026-11-12.

## Frequently asked questions

### Is SAMI the same as SAMA?

No. SAMA is the Saudi Central Bank, which issues the framework. SAMI is S3M’s analytics product, which answers security questions from telemetry.

### Does S3M replace a SIEM for section 3.3.14?

No. S3M provides access records and alerts that your SIEM or security operations team can use.

### Which S3M product fits bank branches and ATMs?

ConnGuard NAC for branch networks and APNZone for ATMs and terminals that connect over private APN.