The terms used across MARSAD and SAMA conversations.

If a term you need isn't here, get in touch via hello@marsadcomply.com and we'll add it.

A note on the wording. "Important", "Critical", and "Material" are not synonyms. Each carries a specific meaning the regulator expects to see used precisely. Where SAMA defines a term, this glossary uses SAMA's word; where SAMA delegates to the bank (common for thresholds and numeric bands), the glossary marks the distinction.

Accountable Executive (AE)

The named senior owner of an outcome, typically used in MVB and framework sign-off. Sits in parallel with the CRO on dual-signoff declarations.

Action

A piece of remediation work tied to a finding, with an owner, a due date, and a workflow state. Lives under the "Findings & actions" pillar.

Attestation

A periodic confirmation by an owner that a control or a service is operating as expected. Has a cycle (monthly, quarterly, etc.) and a sign-off ledger attached.

Audit log

Append-only record of state changes, comments, and ownership transfers on every workflow-bearing artefact. Surfaces on artefact pages as the timeline panel.

BCM

SAMA Business Continuity Management framework. One of the framework lenses MARSAD ships; the foundation for recovery-objective requirements and the BIA mandate.

BIA: Business Impact Analysis

Structured assessment of the impact of disruption to a business activity. Produces criticality classifications and recovery objectives. Mandated by SAMA BCM 2.4 as the foundation of the BCM programme; banks produce it themselves; MARSAD captures the outputs but does not generate the BIA.

BIAN landscape

An industry-standard service-domain map (BIAN: Banking Industry Architecture Network). MARSAD uses it as a shared reference frame so IBS registers are comparable across banks and across regulator conversations.

CBS: Critical Business Service

A service that is internally critical to the bank's operations but is not customer-facing in the IBS sense. Examples: regulatory reporting infrastructure, Treasury risk engines, GL / financial accounting. Distinct from IBS, which carries the customer-facing orientation. SAMA anchor: ITGF 3.2.1-CR5's three-tier IT asset scale (mission critical / critical / non-critical).

Critical

In SAMA framing, internal continuity orientation: if this fails, the bank can't operate. The "C" in CBS / CBF. Distinct from "Important" (customer-facing) and "Material" (regulatory trigger or financial threshold).

Cross-walk

The mapping between a control in one framework and the related controls in other frameworks. Lets a bank avoid contradicting itself across overlapping lenses.

CSF

SAMA Cyber Security Framework. One of the framework lenses MARSAD ships out of the box.

CRFR

SAMA Cyber Resilience Framework. Successor / sibling to CSF, focused on the resilience dimension of cyber.

CRO

Chief Risk Officer. Typically signs every MVB declaration in parallel with the Accountable Executive.

Declaration

A scoped, signed statement of the bank's position, most often used for MVB. Has scope, operating attributes, signatories, and a sign-off ledger.

Drill

A test against a declared MVB or against a specific resilience scenario. Outcomes attach back to the declaration that scoped them.

Evidence pack

A bundled, signed export (PDF for reading, JSON for computing, plus a verifiable proof) walking a regulator through a service or a cycle's artefacts: scope, signatories, tests, findings, attestations.

Finding

A point where a control, a test, or an attestation has surfaced something that needs work. Findings flow into actions, which carry ownership and due dates.

Framework lens

One of the SAMA frameworks (ITGF, CSF, CRFR, BCM, Counter-Fraud, Outsourcing) loaded into MARSAD as a structured catalogue, assessed on a recurring cycle.

IBS: Important Business Service

A service whose disruption would meaningfully impact customers, the bank, or the financial system. The unit of OpRes work, the spine of the platform.

IBS register

The full list of identified IBS, with the rationale, owners, and review cadence preserved alongside the entries.

Important

Customer / external orientation: if this fails, customers or financial stability suffer. The "I" in IBS. Distinct from "Critical" (internal continuity) and "Material" (regulatory trigger or financial threshold).

ITGF

SAMA IT Governance Framework. The first framework lens MARSAD shipped, focused on IT governance posture.

Material

In SAMA framing, "material" is a regulatory review trigger ("material change", "material outsourcing"). MARSAD's IBS scoring criterion was originally named "financial materiality" (industry usage) and was renamed to financial impact in 2026 to eliminate the dissonance against SAMA's vocabulary. The criterion measures the financial exposure if the service fails (magnitude), not a regulatory trigger.

Maturity ladder

The graduated stages used by the maturity roadmap, from "starting out" through to "advanced steady state".

Mission critical / Critical / Non-critical

SAMA ITGF 3.2.1-CR5's three-tier IT asset classification. Mission-critical and critical assets reviewed at least annually; non-critical reviewed based on importance to the business. The only explicit SAMA-defined service tiering across the loaded framework set; MARSAD's taxonomy maps onto these tiers.

MVB: Minimum Viable Bank

The declared floor of services that must remain available under stress. A scoped subset of the IBS register, signed by CRO and AE, drilled regularly.

MTPD / MAO

Maximum Tolerable Period of Disruption / Maximum Acceptable Outage. The outermost time band before disruption to an IBS becomes intolerable. SAMA BCM 2.4-3 mandates the definition; thresholds are bank-defined; SAMA does not stipulate numeric bands.

Operational twin

MARSAD's category claim: a living model of the bank that has to keep running, distinct from the paper controls that traditional GRC platforms manage. Bounded to operational resilience (services, dependencies, blast radius, resilience state, obligations) but not financial, customer, or treasury twinning. Faithfulness, freshness, time-queryability, and simulation-capability are the four axes that make the claim defensible.

OpRes

Operational resilience. The discipline SAMA's framework asks regulated entities to operate, and the spine MARSAD is organised around.

OpRes lifecycle

The recurring identify → map → test → declare → evidence cycle. See the OpRes lifecycle page.

Outcome category

A label on each IBS describing the type of customer or systemic outcome the service delivers. Used to group the register and to ensure scorecards aren't dominated by one category.

Pillar

One of the four governance pillars MARSAD organises day-to-day work around: Findings & actions, Periodic attestations, Resilience tests, Third parties.

Risk appetite

The bank's stated tolerance for risk, owned by the CRO function and approved by the board. SAMA anchor: Counter- Fraud 4.2 requires definition along organisation impact and customer impact dimensions, with CEO / Board escalation on breach. MARSAD surfaces the appetite as soft guidance when admins set thresholds or score IBS; the statement is the binding authority.

SAMA

Saudi Central Bank, the regulator whose frameworks MARSAD is shaped around.

Severity 1-5

MARSAD's internal scale for findings and incidents: 1 insignificant, 2 minor, 3 moderate, 4 major, 5 catastrophic. SAMA bridge: BCM 2.11-1 mandates reporting at "Medium" or "High"; MARSAD's bridge is severity 4-5 ≈ High, severity 3 ≈ Medium. The 1-5 is for operational granularity; the bridge governs regulator submission.

Significant

Middle-tier term in some frameworks between "material" and "immaterial". SAMA framework data does not define it as a category; MARSAD does not use it as a classification level. Included here for clarity when it surfaces in external documents.

Sovereign-mandated services

Services mandated by SAMA that are operationally non-negotiable for any participating bank, SARIE, SADAD, SPAN, mada, IPS, Etimad. Bypass MVB scoping gates.

Supporting service

A service that underpins one or more IBS or CBS but is not critical in its own right. Examples: CIAM, message bus, settlement engine, KYC. SAMA anchor: ITGF 3.2.1-CR5's "non-critical information assets … assessed based on their importance to the business", the qualifier that separates a supporting service from a non-critical / out-of-scope one.

Third party

An external supplier or partner that an IBS depends on. Lives under the "Vendors" pillar; incidents that touch an IBS thread back to that service's record.

Trend signal

A measurable indicator the maturity roadmap watches, e.g. test pass rate, finding closure rate. Trend, not point-in-time.

Workflow template

A configurable review-and-sign-off pattern attached to an artefact type. Different artefacts get different templates; admins can tune per framework.