Business Continuity Management Framework

Scope The BCM framework document defines principles, objectives and control considerations for initiating, implementing, maintaining, monitoring and improving business continuity controls in member organizations. The BCM framework document is applicable to the full scope of the Member Organization, including subsidiaries, employees, subcontractors, third-parties and customers. The BCM framework document has an interrelationship with other corporate policies for related areas, such as enterprise risk management, health, safety and environment (HSE), physical security, cybersecurity (including cyber resilience and incident management). 1.4 Applicability The BCM Framework document is applicable to following: All organizations affiliated with SAMA ("the Member Organizations") All banks operating in Saudi Arabia All banking subsidiaries of Saudi banks Subsidiaries of foreign banks situated in Saudi Arabia 1.5 Responsibilities SAMA mandates the BCM framework requirements document to Member Organizations. This document outlines the BCM requirements to be implemented by the Member Organizations. SAMA is the owner and is responsible for periodically updating the BCM Framework document. The Member Organizations are responsible for adopting and implementing the requirements stated in this framework document. 1.6 Interpretation SAMA, as the owner of the BCM framework requirements document, will provide interpretations of the principles, objectives and control considerations, if required. 1.7 Target Audience This document is intended for board of directors, CEOs, chief risk officer, senior and executive management, business owners, owners of information assets, CIOs, CISOs, business continuity managers, internal auditors and for those, who are responsible for and involved in defining, implementing and reviewing business continuity controls. 1.8 Review, Changes and Maintenance This document will be reviewed and maintained by SAMA. SAMA will review this document periodically to determine its effectiveness, including the effectiveness of the framework to address emerging business continuity threats and risks. If applicable, SAMA will update this document based on the outcome of the review. If a Member Organization considers that an update to this document is required, the Member Organization should formally submit the requested update to SAMA after obtaining approval from the business continuity manager and business continuity steering committee within the Member Organization. SAMA will review the requested update, and when approved, this document will be updated. Version control will be implemented for maintaining this document. Whenever any changes are made, the preceding version should be retired and the new version should be published and communicated to all Member Organizations. 1.9 Reading Guide The BCM Framework represents the actual BCM domains and subdomains, principles, objectives, and control considerations. 2. Business Continuity Requirements