Kingdom of Saudi Arabia – Saudi Central Bank (SAMA)

Kingdom of Saudi Arabia – Saudi Arabian Monetary Authority – Information Technology Governance Framework – November 2021. Covering:

1. Introduction

1.1 Introduction to the Framework

1.2 Definition of Information Technology Governance

1.3 Scope

1.4 Applicability

1.5 Responsibilities

1.6 Interpretation

1.7 Target Audience

1.8 Review, Updated and Maintenance

1.9 Reading Guide

2. Framework Structure and Features

2.1 Structure

2.2 Principle-based

2.3 Self-assessment, Review and Audit

2.4 Information Technology Governance Maturity Model

2.4.1 Maturity Level 3

2.4.2 Maturity Level 4

2.4.3 Maturity Level 5

3. Control Domains

3.1 Information Technology Governance and Leadership

3.1.1 Information Technology Governance

3.1.2 Information Technology Strategy

3.1.3 Manage Enterprise Architecture

3.1.4 Information Technology Policy and Procedures

3.1.5 Roles and Responsibilities

3.1.6 Regulatory Compliance

3.1.7 Internal IT Audit

3.1.8 Staff Competence and Training

3.1.9 Performance Management

3.2 IT Risk Management

3.2.1 Managing IT Risks

3.2.2 Risk Identification and Analysis

3.2.3 Risk Treatment

3.3.4 Risk Reporting, Monitoring, and Profiling

3.3 Operations Management

3.3.1 Manage Assets

3.3.2 Interdependencies

3.3.3 Manage Service Level Agreements

3.3.4 IT Availability and Capacity Management

3.3.5 Manage Data Center

3.3.6 Network Architecture and Monitoring

3.3.7 Batch Processing

3.3.8 IT Incident Management

3.3.9 Problem Management

3.3.10 Data Backup and Recoverability

3.3.11 Virtualisation

3.4 System Change Management

3.4.1 System Change Governance

3.4.2 Change Requirement Definition and Approval

3.4.3 System Acquisition

3.4.4 System Development

3.4.5 Testing

3.4.6 Change Security Requirements

3.4.7 Change Release Management

3.4.8 System Configuration Management

3.4.9 Patch Management

3.4.10 IT Project Management

3.4.11 Quality Assurance

Appendicies

Appendix A – How to request an Update to the Framework

Appendix B – Framework Update Request Form

Appendix C – How to request a Waiver from the Framework

Appendix D – Framework Waiver Request Form

Appendix E – Glossary