trio.so

SAMA CSF compliance, checked on every device

The SAMA Cyber Security Framework expects banks, insurers and finance companies to protect every information asset they run. trio.so includes a SAMA CSF template (Beta), applies the device controls as policies, checks them on a schedule, and keeps the evidence for your assessment. One console for Windows, macOS, Linux, iOS/iPadOS and Android.

Start free trialBook a demo
  • Regional Leader, EMEA, Spring 2025
  • Easiest To Do Business With, Mid-Market, Spring 2025
  • Momentum Leader, Spring 2025
  • High Performer, Middle East, Spring 2025
  • Best Support, Mid-Market, Spring 2025

Rated 4.8 on G2

Endpoint compliance  ›  Frameworks  ›  SAMA CSF
  • Critical patches installed3.3.17Vulnerability Management
    critical0 devices
  • Disk encryption on3.3.9Cryptography
    critical7 devices
  • Firewall on3.3.8Infrastructure Security
    high5 devices
  • Work profile passcode applied3.3.10BYOD
    high4 devices
  • Device owner assigned3.3.3Asset Management
    medium3 devices
Patch jobCritical patches · 14 branch PCs
Resolved
Resolved after next evaluation
Audit trail

10:05Trio · Finding resolved · Critical patches installed (3.3.17) · open → resolved after next evaluation · 14 devices

  • Diyar Private Academy
  • Wires & Fabriks
  • Corvuss American Academy
  • Arabi Company W.L.L.
  • Loglass
  • Skill Authority
  • Bright Learners
  • Synonym
  • Trell

Maturity level 3 needs controls you can show

SAMA expects member organizations to operate at maturity level 3 or higher: controls that are structured and formalized, not ad hoc. On devices, that means the same settings applied everywhere, from head office to the smallest branch, and a record that proves it.

  • Assets first3.3.3 Asset Management starts with knowing every device and who owns it.
  • Own devices count3.3.10 is a subdomain of its own for Bring Your Own Device.
  • Systems need hardening3.3.8 Infrastructure Security covers the computers and servers your staff rely on.
  • Patches have to keep up3.3.17 Vulnerability Management expects vulnerabilities found and fixed.
Devices passing an access check

How it works

Continuous compliance for SAMA CSF device controls

A yearly review shows how devices looked on one day. trio.so automates the device checks instead and runs them on the schedule you set, so a gap shows up the week it appears.

  1. Turn on SAMA CSFActivate the template (Beta) for Windows, macOS, Linux, iOS/iPadOS and Android.
  2. Watch the gapsFindings per control, ranked by severity and devices affected.
  3. Fix and verifyChange the policy or patch the device. trio.so tracks the fix and marks it verified on the next check.
Start free trialBook a demo

Subdomains

SAMA CSF subdomains trio.so helps you meet

Most of the framework covers leadership, risk and third parties. The device work sits in Cyber Security Operations and Technology (3.3), which the SAMA CSF template (Beta) maps to trio.so's checks. Here is how trio.so helps, and where the evidence lives.

SAMA CSF subdomainHow trio.so helpsEvidence in trio.so
3.3.3Asset Management

Lists every device with its owner, serial number, OS and installed apps.

A device inventory you can export as CSV.

3.3.5Identity and Access Management

Syncs users from Microsoft Entra ID, Google Workspace or Okta, provisions accounts over SCIM, and sets passcode policies. Console roles limit who can change what.

The owner on each device record, and passcode policy status.

3.3.8Infrastructure Security

Applies firewall and USB storage policies, and checks Secure Boot, anti-malware and OS updates on each computer.

Findings for each control, device by device.

3.3.9Cryptography

Turns on BitLocker on Windows and FileVault on macOS, checks disk encryption on Linux, and requires encryption on phones.

Encryption status for each device.

3.3.10Bring Your Own Device (BYOD)

Keeps work apps and data in an Android work profile, and requires passcode and encryption on enrolled personal devices.

Policy status for each personal device.

3.3.17Vulnerability Management

Ranks vulnerabilities by CVSS, EPSS and the KEV list, then patches the OS and third party apps on your schedule.

Patch history: each job, the devices it reached and the result.

Subdomain numbers from the SAMA Cyber Security Framework, SAMA Rulebook.

Controls

Enforce SAMA CSF controls on every device

Head office and branches drift apart when each one is set up by hand. trio.so sends the same configuration policies to every device and reports their status back: applied, failed or pending.

  • Same settings everywhereOne policy reaches every PC and laptop, in every branch.
  • EncryptionBitLocker, FileVault, Linux disk encryption and phone encryption.
  • Screen lockAuto-lock minutes, passcode length and lockout after failed attempts.
  • USB and Wi-FiUSB storage blocked on Windows and Linux, and WPA2 or WPA3 Wi-Fi.

Remediation

Track fixes before the next assessment

Maturity is about consistency. When a device drifts, trio.so turns it into a finding with a due date, and the record shows when the control came back.

  • Findings with due datesFailing controls ranked by severity and devices affected.
  • Tracked fixesFix the policy or patch the device, and trio.so follows the finding until it closes.
  • Verified next checkA finding closes only after the next check passes on that device.
  • Audit trailFramework changes, evaluations and resolved findings, with who, when and what changed.
A laptop failing a check, the setting fixed, and the laptop passing on the next check

Try the SAMA CSF template (Beta) in a free trial

Start a free trial, enroll a few devices and turn on the SAMA CSF template (Beta). The findings fill in from your own devices.

Start free trialBook a demo
5
platforms, Linux included
$5
Plans start at $5 per device.
14 days
free trial, no credit card
24/5
support from our team
Monday to Friday

Every OS

SAMA CSF checks on every platform

Branch PCs, executive laptops and staff phones report different signals. Here is what trio.so checks on each.

  • Windows
  • macOS

Windows and macOS

Screen lock, BitLocker or FileVault, firewall, Secure Boot, OS updates and anti-malware, plus the status of every policy.

  • Linux

Linux

Disk encryption, firewall and OS updates, plus the status of core policies.

  • iOS/iPadOS
  • Android

iOS/iPadOS and Android

Whether passcode, encryption and other policies are applied on each phone and tablet, including Android work profiles.

Evidence

Evidence for your SAMA CSF assessment

A maturity assessment looks for controls that work the same way every time. trio.so keeps the device evidence as it works, so you can show the pattern, not one good day.

  • Gap historyThe audit trail shows when each gap opened and when the next check closed it.
  • Evidence recordsEach check result with its source, time and freshness.
  • Policy status per deviceApplied, failed or pending, for every policy.
  • Inventory exportEvery device with owner, serial number and OS.
  • Patch historyEvery patch job and the devices it reached.
  • ExportsEvidence for your assessment file.

Why trio.so

Device controls for regulated finance teams

Banks and insurers in Saudi Arabia often answer to SAMA and NCA at once. trio.so keeps both next to the console that manages the devices.

  • Saudi templates

    SAMA CSF and NCA ECC templates (Beta), in trio.so, next to SOC 2, ISO 27001 and NIST.

  • Pricing you can read

    Plans start at $5 per device. Endpoint compliance is in the Secure plan and above.

  • Rated 4.8 on G2

    Support from real people 24 hours a day, Monday to Friday.

Related

Related compliance features

Pair SAMA CSF device checks with these trio.so features.

Integrations

Works with the tools you already use

Stream device events to Splunk for your security operations, see Microsoft Defender for Endpoint alerts per device, bring users in from Microsoft Entra ID or Okta, send device compliance to Vanta, and send alerts to Slack or Microsoft Teams.

  • Vanta
  • Microsoft Defender
  • Splunk
  • Slack
  • Microsoft Teams
  • Microsoft Entra ID
  • Okta

SAMA CSF FAQ

The Cyber Security Framework of the Saudi Central Bank, known as SAMA. It has four domains: cyber security leadership and governance, risk management and compliance, operations and technology, and third party cyber security. Our guide to SAMA compliance explains each one.

Organizations SAMA regulates: banks, insurance and reinsurance companies, financing companies and credit bureaus operating in Saudi Arabia, and the financial market infrastructure.

The framework scores maturity from 0 to 5. Member organizations should operate at level 3 or higher, which means controls that are structured and formalized.

No tool can on its own. The framework also covers governance, risk management, awareness and third parties. trio.so helps with the device controls: it applies them, checks them and keeps the evidence.

Yes. Our SAMA compliance checklist comes as a PDF and an Excel file.

The device checks, which the SAMA CSF template (Beta) in trio.so maps for you: inventory, encryption, screen lock, firewall, patching and anti-malware, checked on a schedule with the evidence recorded. Read what software can and can't do.

Personal Android phones are managed through a work profile, which keeps work apps and data apart from personal ones, with passcode and encryption required.