ISO 28000 vs SAMA CSF
ISO 28000
International standard for supply chain security management systems
SAMA CSF
Saudi framework for financial sector cybersecurity maturity
Quick Verdict
ISO 28000 provides voluntary supply chain security certification for global logistics firms, while SAMA CSF mandates cybersecurity maturity for Saudi financial institutions. Organizations adopt ISO 28000 for market access and resilience; SAMA CSF ensures regulatory compliance and operational continuity.
ISO 28000
ISO 28000:2022 Security management systems – Requirements
Key Features
- Risk-based supply chain security management system
- PDCA cycle for continual improvement
- Aligns with ISO High Level Structure
- Scalable across organization sizes and industries
- Supports third-party certification via accredited bodies
SAMA CSF
SAMA Cyber Security Framework Version 1.0
Key Features
- Six-level maturity model mandating Level 3 minimum
- Board-level governance and independent CISO requirement
- Detailed controls for payment systems and e-banking
- Third-party and cloud security with data residency rules
- Periodic self-assessments and SAMA audits
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
ISO 28000 Details
What It Is
ISO 28000:2022 — Security and resilience — Security management systems — Requirements is an international management system standard. It defines requirements for establishing, implementing, maintaining, and improving a security management system (SMS) focused on supply chain security. The standard uses a risk-based approach with PDCA cycle, aligning with ISO High Level Structure for integration.
Key Components
- Clauses 4-10 cover context, leadership, planning, support, operation, evaluation, improvement.
- Emphasizes risk assessment, security policy, operational controls, performance metrics.
- Built on ISO 31000 risk principles and ISO 22301 resilience.
- Optional certification via accredited bodies.
Why Organizations Use It
- Reduces supply chain disruptions, theft, sabotage risks.
- Meets contractual, customs facilitation needs (e.g., C-TPAT equivalents).
- Lowers insurance costs, enhances market access.
- Builds stakeholder trust, competitive edge in logistics, manufacturing.
Implementation Overview
- Phased: scoping, gap analysis, risk treatment, deployment, audits.
- Scalable for SMEs to multinationals in logistics, pharma, ports.
- Involves supply chain mapping, supplier governance, training.
- Certification requires Stage 1/2 audits, surveillance.
SAMA CSF Details
What It Is
SAMA Cyber Security Framework (SAMA CSF) is a mandatory regulatory framework issued by the Saudi Central Bank in 2017 for financial institutions. It establishes principle-based cybersecurity requirements to protect information assets, aligned with NIST, ISO 27001, PCI DSS, and Basel. Its risk-driven approach uses a six-level maturity model targeting at least Level 3.
Key Components
- Four domains: Leadership and Governance, Risk Management and Compliance, Operations and Technology, Third-Party Security.
- Comprehensive sub-controls across objectives in a 4-domain structure.
- Maturity model from Level 0 (Non-existent) to Level 5 (Optimized).
- Self-assessments and SAMA audits; no external certification but waiver processes.
Why Organizations Use It
- Mandatory for banks, insurers, fintechs in Saudi Arabia to ensure resilience.
- Reduces cyber risks, enables continuous monitoring, supports Vision 2030 digital goals.
- Builds board-level accountability, enhances incident response, avoids penalties.
- Boosts stakeholder trust and competitive edge in regulated sector.
Implementation Overview
- Phased: gap analysis, governance setup, control deployment, monitoring.
- Applies to all SAMA-regulated entities; scalable by size.
- Periodic self-assessments, internal audits; SAMA reviews maturity.
Key Differences
| Aspect | ISO 28000 | SAMA CSF |
|---|---|---|
| Scope | Supply chain security management systems | Cybersecurity for financial institutions |
| Industry | Logistics, manufacturing, global supply chains | Saudi financial sector (banks, insurance) |
| Nature | Voluntary international management standard | Mandatory regulatory framework |
| Testing | Third-party certification audits | Self-assessments and SAMA audits |
| Penalties | Loss of certification, no legal penalties | Fines, license suspension, enforcement actions |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about ISO 28000 and SAMA CSF
ISO 28000 FAQ
SAMA CSF FAQ
You Might also be Interested in These Articles...
CMMC Level 2 Implementation Guide for Small DIB Contractors: First 5 Steps to C3PAO Certification with Infographic
Actionable CMMC Level 2 guide for small DIB contractors: 5-step roadmap to C3PAO certification with infographic on timelines, costs & POA&Ms. Achieve DoD compli
NIST CSF 2.0 Supply Chain Risk Management: Complete Playbook with Profiles, Tiers, and Vendor Assessment Templates
Master NIST CSF 2.0 ID.SC supply chain risk management with vendor assessment templates, profile gap analysis, and tier strategies. Mitigate third-party threats
NIST CSF 2.0 Govern Function Deep Dive: Building Executive Cybersecurity Governance from Scratch
Step-by-step blueprint for NIST CSF 2.0 Govern function: templates, RACI matrices, metrics to elevate cybersecurity governance to boardroom level. Reduce breach
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Explore More Comparisons
See how ISO 28000 and SAMA CSF compare against other standards