A bank lives under several overlapping frameworks. MARSAD treats each as a lens, runs assessments on a cycle, and threads findings back to the OpRes spine.
A framework assessment is a control-by-control review of how the bank measures up against a published framework, what is in place, what is partial, and what is gapped. SAMA-regulated entities sit under several frameworks at once. MARSAD treats each as a separate lens on the same underlying truth.
Currently in scope:
The frameworks are not a checklist exercise. They each ask for posture, evidence, and a credible review cycle. A bank that can produce control-level commentary today, a recent assessment, and a plausible improvement plan looks very different to a regulator from a bank that produces a static spreadsheet at audit time.
Treating the frameworks as separate lenses also matters internally. The conversation about cyber posture and the conversation about IT governance are related but not the same. Forcing them through one collapsed view loses the nuance both audiences need.
Each framework is loaded as a structured catalogue of controls. Assessments run on a recurring cycle that the bank picks, quarterly, semi-annual, or annual, depending on the framework and the bank's appetite. Within a cycle, each control gets:
Where the same underlying control appears in more than one framework (and many do) MARSAD maintains a cross-walk so the bank doesn't end up with two contradictory assessments for the same operating reality.