Cybersecurity Compliance for GCC Businesses: What SAMA and NESA Actually Require

For businesses operating in the Gulf, “cybersecurity compliance” often gets treated as a vague, generic obligation. In practice, the two most significant frameworks in the region — Saudi Arabia’s SAMA Cyber Security Framework and the UAE’s NESA regulation — have specific, documented technical and governance requirements. Understanding what they actually ask for is more useful than a generic compliance checklist.

Saudi Arabia: the SAMA Cyber Security Framework

The Saudi Arabian Monetary Authority (SAMA) issued its Cyber Security Framework to give regulated financial institutions — banks, insurance and reinsurance companies — a standardised set of protocols, practices, and methodologies for building cyber resilience. Key elements include:

• Digital certificate deployment mandated for critical banking transactions, client authentication, and inter-bank settlement processes.
• Tiered obligations by organisation size and risk. Larger, higher-risk institutions face the fullest set of requirements, including mandatory annual self-assessments and SAMA supervisory reviews. Smaller organisations — generally referred to as falling into a scaled or “Class B” category — face a lighter formal audit burden, with independent audits recommended rather than strictly mandated.
• A consistent baseline regardless of tier: multi-factor authentication, data encryption, regular backups, and incident logging are treated as minimum requirements across both tiers, not just the larger institutions.

Importantly, insurance and reinsurance companies regulated by SAMA are held to the same mandatory obligations as banks in several respects — this isn’t a framework that only concerns traditional banking.

UAE: the NESA framework

The UAE’s National Electronic Security Authority (NESA) framework establishes cybersecurity requirements specifically for organisations classified as critical infrastructure — a category that in practice extends into financial services, alongside sectors like energy, telecommunications, and government services. NESA’s requirements focus on governance, risk management, continuous monitoring, and incident response, with some genuinely specific technical requirements worth knowing:

• AES-256 encryption required for data at rest.
• TLS 1.2 as the minimum standard for data in transit.
• A structured approach to continuous monitoring rather than point-in-time assessment alone.

Why this matters even if you’re not directly regulated

Most SMEs in the region aren’t directly bound by SAMA or NESA — those frameworks apply specifically to regulated financial institutions and critical infrastructure. But the practical reality for a lot of Gulf businesses is that clients, partners, or the banks they work with increasingly ask about alignment with these frameworks, even informally, because they’ve become the recognisable regional reference point for “is this business handling data responsibly.” A business that can point to AES-256 encryption at rest, TLS 1.2 minimum in transit, MFA everywhere, and a real incident logging process is answering that question convincingly — regardless of whether a regulator requires it.

Cross-jurisdictional operations

If your organisation operates in both Saudi Arabia and the UAE and falls within scope of both frameworks — a regulated financial entity with a presence in each market is the clearest example — compliance generally needs to be demonstrated to each regulator independently. The two frameworks share a similar spirit (strong authentication, encryption, monitoring, incident response) but are administered separately, with their own specific documentation and assessment expectations.

Security recommendations

• Confirm whether your organisation is actually in scope for SAMA (financial institutions) or NESA (critical infrastructure) before assuming either applies — and if neither applies directly, treat their baseline controls as a credible reference point rather than an obligation.
• Implement the shared baseline regardless of formal scope: MFA across all access points, encryption at rest and in transit meeting or exceeding the AES-256/TLS 1.2 standards NESA specifies, regular tested backups, and real incident logging.
• Don’t wait for a mandatory audit to find gaps. SAMA’s own framework recommends independent audits for smaller institutions even where they aren’t compulsory — an independent gap analysis is a low-cost way to know where you actually stand.
• Document your controls, not just implement them. Both frameworks emphasise governance and evidence, not just technical configuration — being able to show what you do, and when, matters as much as doing it.
• Get region-specific compliance guidance before assuming a Western framework (ISO 27001, SOC 2) automatically satisfies a Gulf regulator. There’s meaningful overlap, but SAMA and NESA have their own specific documented requirements that a generic international certification doesn’t automatically cover.

Key takeaways

SAMA and NESA aren’t abstract regulatory language — they specify concrete controls (MFA, AES-256 encryption at rest, TLS 1.2 in transit, tiered audit obligations, incident logging) that apply directly to regulated financial institutions and critical infrastructure in Saudi Arabia and the UAE respectively, and serve as a credible reference baseline for everyone else in the region. Knowing which framework actually applies to your organisation — and what its baseline controls specifically require — is a more useful starting point than treating “GCC compliance” as one generic obligation.

Shahid Security’s Compliance & Risk Assessment service maps your current controls against the specific framework you need — including regional and international standards — and builds a realistic remediation plan, not just a checklist.

Not sure where your business actually stands against the framework that applies to you? Book a free consultation to talk through a gap analysis.

---

Sources: SAMA Cyber Security Framework and NESA regulatory documentation, via published regulatory guidance and industry compliance analysis, 2026.