For BCM, IT disaster recovery and audit teams at banks in Saudi Arabia and the GCC. Keep the BIA, plans, DR tests, incidents and SAMA notifications in one dataset, so the evidence an examiner samples is already linked together.
Each summary links to our guide, which works from the regulator’s own text and cites it.
Saudi Arabia
Saudi Arabia
United Arab Emirates
An annual test programme shows which of its five coverage themes (IT system loss, cyber, critical vendor, staff and workspace) this year's tests have covered and which they have not. Each test links to the plans it tested, records observations, and raises improvement actions with an owner and an end date.
BIAs are records with owners, approval and review dates, not documents. The MTPD is derived from the impact-over-time matrix, and a consistency check flags an RTO that no longer fits inside it.
DR tests capture the mode (failover, failback, backup restore and others), target and achieved RTO and RPO, the data-integrity result and whether failback completed.
Classifying an incident as medium or high starts a SAMA notification clock with a due time. The notification moves from draft through approval to submission, with the reference number, and the incident cannot close while one is outstanding.
| What a bank needs | Module | What it holds |
|---|---|---|
| Governance, policy and training | Governance | The BCM committee's seats, deputies, meetings and decision register; the policy, charter and methodologies with versions, maker-checker approval and review dates; training records with plan-team coverage; board and evidence packs as PDF |
| Business impact analysis | BIA | Impact over time across configurable categories, derived MTPD, RTO and RPO, minimum resumption capacity, and dependencies on processes, applications, locations, vendors and resources |
| Risk assessment | Risk | A risk register linked to the processes, applications, vendors and locations each risk threatens, with controls and treatments |
| Business continuity plans | BCP | Structured plans with activation criteria and authority, target RTO and RPO, response teams, phased recovery steps, stakeholder communications, approval, versioning and an activation log |
| Crisis management | Crisis | Crisis events with impacts, tasks, decisions, a timeline, situation reports and the plans they activated |
| Testing, including IT DR | Exercises | Annual programmes, scenarios, objectives, injects, observations, after-action reviews and DR tests with achieved RTO and RPO |
| Incidents and SAMA notification | Incidents | Classification, status history, actions, root cause, and SAMA notifications with due times, approval and submission records |
| Staff notification | Call trees | Call trees with acknowledgement tracking, and messages in English and Arabic |
| Evidence for the board and examiners | Reporting | Cross-module reporting, PDF exports of plans and BIAs, an audit log of every change, and a read-only auditor role |
Yes. Section 1.4 of the framework lists all banks operating in Saudi Arabia, the banking subsidiaries of Saudi banks and the subsidiaries of foreign banks in the Kingdom, alongside other SAMA member organisations. A May 2022 circular extended it to insurers and reinsurers.
Hold the BIA, plans, tests and incidents in one dataset, so that a test references the plan it tested, an improvement action traces to the test that raised it, and an incident shows the regulator notification it triggered. That linkage is what an examiner or internal auditor samples. It also needs IT disaster recovery tests with measured recovery times, not just tabletop records.
Yes. Classifying an incident as medium or high starts a notification clock with a configurable due time, and the notification goes through draft, approval and submission with its reference number recorded. An incident cannot be closed while its notification is unsubmitted.
For the BIA, plans, testing and incident register, yes. The CBUAE's own notification steps (4 hours, 24 hours, return to normal, and 72 hours for high-risk incidents) are not yet a separate clock in the product, so track them explicitly until that ships.
Yes. The auditor role can view every module and run reports without being able to change plans, BIAs or tests, and every change made by other users is recorded in the audit log.
Each customer's data sits in its own database schema. Hosting is in the EU by default; in-region hosting in Saudi Arabia or the UAE is not available today. If residency is a contractual or regulatory requirement for you, raise it with us before you sign.
A 20-minute walkthrough of one critical service, from BIA to plan, DR test, incident and SAMA notification.
Book a demo