On your premises
Installed in your own data centre or private cloud, for data that must not leave your walls.
For organizations that must comply
Ready for an assessment on any day.
For CISOs, data protection officers and GRC offices in government entities and the private sector: one record of controls, owners, evidence and reviews across every framework you answer to.
- 37frameworks from NCA, SDAIA and NDMO in the library
- 1,300+assessable requirements, taken from the official texts
- 3modules on one record: governance, risk and compliance
- 3ways to deploy: on your premises, in CIYAJ Cloud or inside your Microsoft 365
Dashboards
Know where you stand, and prove how you got there.
Every figure counts from the controls behind it, and every chart opens the record it summarizes.
Grades
- Initialbelow 50
- Developing50 to 74.9
- Substantial75 to 89.9
- Advanced90 and above
A framework is capped at Substantial while any main control is Not implemented, so a high average never hides a gap.
Where compliance stands
Each main control, under three measures side by side.By cycles80.5%SubstantialEach control's latest validated result
By aging79.5%Substantial · 6 not countedOnly results still within the review period
By current evidence54.5%DevelopingDeliverables proven today by in-date files
In date 99Due soon 3Out of date 6Never assessed 0
How it has moved
The index at the end of each month, under each measure.By cyclesBy agingBy current evidence
Where the work is
Main controls by review stage, within or past the stage time.116Owner preparing
16Line manager
29Second line
15Compliance validation
Within the stage timeOverdue
Every control, every cycle
The validated result of each main control in each cycle.20242025202620271-1-11-1-21-2-12-1-12-2-32-2-42-2-52-3-33-1-14-1-1
ImplementedPartially implementedNot implementedNot applicableNot yet rated
By domain
ECC-2:2024, validated results in the 2027 cycle.- 1Cybersecurity governance84.2%
- 2Cybersecurity defense77.9%
- 3Cybersecurity resilience81.0%
- 4Third-party and cloud cybersecurity72.4%
Automation
The follow-up runs itself.
CIYAJ sends every assignment, reminder and approval request on its own, chases what is late and collects the answers. Nobody has to remember to follow up.
CIYAJSpots what is due and who owes it
Sent automaticallyAssignments, reminders and escalations
People actApprove or return in the portal or by email
Record updatedAnswer verified, trail kept
Every working morning, until the work is done
- Every notice sent for youAssignments, review requests, returns, validations and renewals go out automatically. A notice that fails can be sent again.
- Approve wherever suits youReviewers approve or return in the CIYAJ portal or straight from their email. CIYAJ applies an answer only after checking who answered, that they were asked and that the request is still current.
- One reminder a day, not tenReminders before a step is due and escalations when it is overdue, grouped into one message per person each working morning.
- Evidence that stays currentRenewal notices before files expire. Expired evidence is marked, and the current-evidence measure moves with it.
- Test first, then liveRun every notice to a test address first. Switch to Live when you are ready.
- Procedures you controlEdit the procedures and review chains in CIYAJ. Publishing a new version changes what happens next.
What people receive
CIYAJ · approval request
Review ECC 2-2-3: Multi-factor authentication
Submitted by the control owner with 3 evidence files. Due tomorrow.
ApproveReturn
Across the governance modules, CIYAJ also files incoming email into the right register, sends documents and letters for e-signature, and sends weekly digests.
Same features in every option
CIYAJ Cloud
Hosted and run for you. Nothing to install, and updates arrive without effort on your side.
With your Microsoft 365
For Microsoft 365 organizations, two ways to run it:
- In your own tenant, so records stay in your Microsoft 365
- With CIYAJ Cloud, with notices and approvals still reaching your Microsoft 365 email
Integrates with the enterprise platforms you already run
CIYAJ accepts integration with the most widely used enterprise platforms on the market, including IT service management, document management, e-signature, and email and collaboration suites, so records arrive where they belong and nobody types them twice.
- Your data stays where you deploy itRecords and evidence live in the deployment you choose. Nothing is copied elsewhere.
- An access matrixCapabilities per role, framework visibility, an evidence classification ceiling and an access review export.
- Evidence classificationEach evidence file carries a classification. People see only what is at or below their ceiling.
- Read-only for assessorsAuditors see the record but cannot change it, and external access ends on the date you set.
- A change log and a trailWho changed what in settings, and every decision on every control.
- Answers verifiedAn answer counts only after CIYAJ checks who answered, that they were asked and that the request is still current.
See CIYAJ against your own frameworks.
Tell us which frameworks are in scope and we will arrange a walkthrough with your team.