Governance, risk and compliance for Saudi regulation
CIYAJ keeps every control your organization answers to under NCA, SDAIA and NDMO in one record: who owns it, the evidence that proves it, who reviewed it and how it scores. Assessors see everything in one place, and every gap becomes a corrective action with an owner and a due date.
Who it is for
CISOs, data protection officers and GRC offices in government entities and the private sector.
Firms that deliver NCA, PDPL and NDMO assessments and compliance programmes for their clients.
The platform
Six capabilities share the same controls, people and evidence, so nothing is typed twice and every result can be traced.
For assessors
The Audit Room shows a cycle as it stands, domain by domain and control by control, read-only. Internal assessors and external auditors work from the same record the organization works in.
Remote access to all six parts in scope asks for a second factor. Filed: the access control policy, the configuration export and the Q1 access review.
Implemented. Policy, configuration and review agree. No exception stands.
Dashboards
Every figure counts from the controls behind it, and every chart opens the record it summarizes.
A framework is capped at Substantial while any main control is Not implemented, so a high average never hides a gap.
Automation
CIYAJ writes every notice to one outbox, and Power Automate does the sending, the chasing and the collecting, under your own Microsoft 365 accounts.
Across the governance modules, flows also register incoming email into the right register, send documents and letters for signature through DocuSign, and send weekly digests.
How it works
Frameworks
37 frameworks, from cybersecurity controls to laws, regulations, policies and guidelines, with more than 1,300 assessable requirements taken from the official published texts. CIYAJ works out which frameworks apply to each part of your organization from what happens there: personal data, transfers abroad, telework, social media, IoT or AI.
Many requirements repeat across frameworks. A common control is answered once and applied to each requirement it meets; each framework still validates it in its own right.
1 common control · 4 frameworks · validated in each
CIYAJ is an independent product. It is not affiliated with, approved or endorsed by NCA, SDAIA or NDMO.
Modules
Start with Compliance and add the next module without a new set-up. People, organization and evidence are shared.
Plan a cycle in five steps and follow it to the close.
Accept a risk openly, for a stated time, instead of hiding a gap.
| Number | Document | Stage | Next review |
|---|---|---|---|
| POL-001 | Information Security Policy | Published | Mar 2027 |
| STD-014 | Access Control Standard | Quality check | — |
| PRO-022 | Backup and Restore Procedure | Approved | Jan 2028 |
| PRO-031 | Personal Data Breach Response Procedure | Draft | — |
STD-014 meets 9 obligations across ECC-2:2024 and CCC-2:2024.
Plan, write, review, approve, publish and retire controlled documents.
| Action | Owner | Due | State |
|---|---|---|---|
| SBP-2027-0142Close finding on backup restore time | Head of Infrastructure | Nov 30 | Open |
| SBP-2027-0137Approve data classification for the HR system | Data governance lead | Nov 20 | Slipped 1× |
| SBP-2027-0129Renew the SOC monitoring contract | Procurement lead | Dec 15 | In progress |
The leadership office and the PMO on the same platform.
For consulting and audit firms
Run every NCA, PDPL and NDMO engagement on the same library, the same evidence trail and the same Audit Room, deployed in each client's own Microsoft 365.
| Test | Kind | Sample | Result |
|---|---|---|---|
| ECC 2-2-3 Multi-factor authentication | Operating effectiveness | 5 of 48 | Effective |
| ECC 2-3-3 Patches within the agreed window | Operating effectiveness | 5 of 60 | Partly effective |
| PDPL Records of processing kept current | Design | 1 | In progress |
Security and deployment
CIYAJ is installed on a SharePoint site in your own tenant. Your records stay in your lists and libraries, and the flows run under your accounts.
Questions
In your own Microsoft 365: SharePoint lists and libraries on your site, and Power Automate flows under your accounts. CIYAJ keeps no copy.
Microsoft 365 with SharePoint Online and Power Automate. A site owner installs the package and follows the set-up in the app, and the flows are imported as one solution.
Yes. The External Auditor role gives read-only access to the Audit Room until an end date you set. After that date the role gives nothing.
No. CIYAJ reads uploaded files and regulator documents to fill in what it can and to suggest links between frameworks. People decide: owners rate, reviewers approve and the Compliance team validates.
No. CIYAJ is an independent product. It is not affiliated with, approved or endorsed by NCA, SDAIA or NDMO, and it does not replace your organization's own accountability.
Deploy CIYAJ at each client, in the client's own Microsoft 365, under your look and name. Your assessors work in the Audit Room and test controls on reproducible samples. Choose "A consulting or audit firm" in the form below.
Request a briefing
Whether you run compliance in-house or deliver it for clients, tell us which frameworks are in scope and we will arrange a walkthrough with your team.