Frameworks · Middle East
SAMA 3.3.7 asks that changes include security requirements, assessment and testing. Aspian Cloud makes the security sign-off part of the approval, so it can’t be skipped.
- Instrument
- Saudi Central Bank (SAMA) Cyber Security Framework v1.0 (May 2017); SAMA IT Governance Framework (Nov 2021); CBUAE Operational Risk Management Regulation (Circular No. 1/2026)
- In force
- SAMA CSF v1.0 issued May 2017 and in force. SAMA IT Governance Framework issued 4 Nov 2021. CBUAE Operational Risk Management Regulation issued 3 Feb 2026, effective 14 Sept 2026; it repeals the 2018 Operational Risk Regulation
- For
- Institutions regulated by the Saudi Central Bank or the Central Bank of the UAE.
| Clause | What it requires | Evidenced by |
|---|---|---|
| SAMA CSF 3.3.7 Change Management | The change process for information assets must include cyber security requirements, assessment and security testing of changes.Source: rulebook.sama.gov.sa | Policies that require a security approver and passing scans before a change in scope can be approved. |
| SAMA CSF 3.3.6 / 3.3.5 / 3.4 | Application security standards (3.3.6), identity and access management (3.3.5), and third-party cyber security covering vendors, outsourcing and cloud (domain 3.4).Source: rulebook.sama.gov.sa | Repository baselines, identity and access records, and supplier engagements. |
| SAMA ITGF 3.4 System Change Management (3.4.6) | Security requirements are defined and tested in a test environment for every system change before it reaches production.Source: rulebook.sama.gov.sa | Promotion order: tested in staging before production, recorded on the change. |
| CBUAE Op Risk Mgmt Regulation (C 1/2026) | Covers ICT and cyber controls and outsourcing limits; material changes to critical operations need 30 days' notice and CBUAE no-objection; material events reported within 4 hours.Source: trowers.com | Change records for material changes to critical operations, and incident timelines. |
Clause references and requirements were read on 8 November 2026. The standard is paywalled or the official site refused access, so references were confirmed from reputable secondary sources. Aspian Cloud evidences these clauses; it doesn’t make you compliant, and your assessor decides.
Want the mapping for a framework we don’t list? Ask us. A new framework is a data file, not a code change.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.