SAMA CSF maturity levels: what separates a 3 from a 4

The SAMA Cyber Security Framework does not ask whether a control exists. It asks how mature it is — and that single difference is why organisations with genuinely good controls score lower than they expect.

The levels

1. 0 — Non-existent. Nothing happens, nobody owns it.
2. 1 — Ad hoc. It happens sometimes, driven by individuals. Results depend on who is available.
3. 2 — Repeatable but informal. A consistent practice exists but is not documented or approved. It survives a busy week, not a resignation.
4. 3 — Structured and formalised. Documented, approved, communicated, applied across the whole scope.
5. 4 — Managed and measurable. Effectiveness is measured, and results are reported to management on a cycle.
6. 5 — Adaptive. Measurement drives change; the control adapts to the threat environment.

Why everyone stops at 3

Levels 1 to 3 are about doing the thing properly, which security teams are good at. Level 4 is about proving it works over time, which is a governance activity most teams never set up. It requires four things, none of them technical:

• A numeric definition of what "effective" means for that control.
• Collection of that measure on a schedule.
• Reporting to management, with trend.
• Retention of those reports as evidence.

This is the cheapest maturity increment available and the one most often dismissed as bureaucracy — right up until an assessor caps the score at 3 on controls that are operating perfectly.

Choosing target levels honestly

Level 5 everywhere is neither achievable nor sensible. Target by criticality: controls protecting critical services or regulated data at 4, sometimes 5; most controls at 3; low-risk supporting controls possibly at 2 or 3 with justification.

A self-assessment claiming uniform level 4 across the whole framework is a signal, and not a good one — assessors probe exactly that pattern, because it usually means the model was misunderstood or the scoring was generous.

Evidence per level

Practical guide to what an assessor will want:

• Level 2: people describe the same process consistently, and artefacts exist even if informal.
• Level 3: an approved document, evidence of communication, and records showing it applied across the full scope — partial coverage keeps you at 2.
• Level 4: a defined metric, dated measurements over several periods, and management reports containing them.
• Level 5: a documented change that resulted from the measurement, plus evidence of threat-driven adjustment.

If you also report against the NCA ECC

The ECC asks whether a control is implemented; SAMA asks how mature it is. Same control, same evidence, two different questions — so score twice from one evidence base rather than running two programmes. Organisations subject to both that maintain parallel documentation end up with two sets of evidence that drift apart within a year.

Key takeaways

• SAMA scores maturity, not existence — good controls can still score 3.
• The 3-to-4 step is governance, not engineering.
• Partial scope coverage caps you at 2 regardless of quality.
• Uniform level 4 self-scores attract scrutiny.