CIYAJ سياج
العربية
Menu
Request a briefing

Platform

Governance, risk and compliance on one record.

Three modules, each licensed on its own, sharing people, organization, evidence and the audit trail, so a failed control raises a risk and a policy in force counts as a control.

Governance

Policies, standards and procedures from plan to retirement, a policy portal, and the leadership office's decisions, actions and contracts.

  • Existing documents read, gap-checked and brought in
  • Review routes with a quality check and e-signature
  • A policy portal and acknowledgement campaigns
Explore Governance

Risk

A first-line risk register assessed against your own risk standard, with appetite, treatment, indicators and reports for the committee.

  • Risks from compliance findings, exceptions, incidents and more
  • Inherent, residual and target ratings with appetite limits
  • Key risk indicators, heat maps and the committee pack
Explore Risk

Compliance

Every NCA, SDAIA and NDMO control with owners, evidence, reviews, grades and a read-only Audit Room for assessors.

  • 37 frameworks and more than 1,300 requirements
  • Grades and three measures of where you stand
  • Control testing on reproducible samples
Explore Compliance
  • A failed control test or a compliance finding raises a risk.
  • Control test results suggest a risk's residual rating.
  • A policy in force counts as a control and feeds evidence to compliance.

Automation

The follow-up runs itself.

CIYAJ sends every assignment, reminder and approval request on its own, chases what is late and collects the answers. Nobody has to remember to follow up.

CIYAJSpots what is due and who owes it
Sent automaticallyAssignments, reminders and escalations
People actApprove or return in the portal or by email
Record updatedAnswer verified, trail kept
Every working morning, until the work is done
  • Every notice sent for youAssignments, review requests, returns, validations and renewals go out automatically. A notice that fails can be sent again.
  • Approve wherever suits youReviewers approve or return in the CIYAJ portal or straight from their email. CIYAJ applies an answer only after checking who answered, that they were asked and that the request is still current.
  • One reminder a day, not tenReminders before a step is due and escalations when it is overdue, grouped into one message per person each working morning.
  • Evidence that stays currentRenewal notices before files expire. Expired evidence is marked, and the current-evidence measure moves with it.
  • Test first, then liveRun every notice to a test address first. Switch to Live when you are ready.
  • Procedures you controlEdit the procedures and review chains in CIYAJ. Publishing a new version changes what happens next.
What people receive
CIYAJ · approval request
Review ECC 2-2-3: Multi-factor authentication
Submitted by the control owner with 3 evidence files. Due tomorrow.
ApproveReturn
Your CIYAJ items for todaySunday · 7:00
  • 2 reviews due tomorrow
  • 1 control overdue by 2 working days
  • 3 evidence files expire within 30 days
Open my work

Across the governance modules, CIYAJ also files incoming email into the right register, sends documents and letters for e-signature, and sends weekly digests.

Modules

Each module licensed on its own, all on one record.

Start with Compliance and add the next module without a new set-up. People, organization and evidence are shared.

Illustrative data
Policies / Controlled documentsAcme Organization
NumberDocumentStageNext review
POL-001Information Security PolicyPublishedMar 2027
STD-014Access Control StandardQuality check—
PRO-022Backup and Restore ProcedureApprovedJan 2028
PRO-031Personal Data Breach Response ProcedureDraft—

STD-014 meets 9 obligations across ECC-2:2024 and CCC-2:2024.

Policies

Policies and controlled documents

Bring in, plan, write, review, approve, publish and retire every policy, standard and procedure.

  • Existing documents read and gap-checked as they come in
  • Approval routes that start with a quality check, with e-signature
  • A policy portal, acknowledgement and re-attestation
Risk / RegisterAcme Organization
Technology risk registerResidualInherentCommittee pack
Open risks42
Above appetite3Escalated automatically
Treatment plans1861% on time
Indicator breaches2This month
Likelihood
5
1
1
1
4
2
3
2
3
1
4
6
2
2
2
5
4
1
1
3
3
1
1
2
3
4
5
Impact
  • RSK-2027-014CriticalAbove appetiteLegacy OT network without segmentationTreatment plan35%
  • RSK-2027-021HighAbove appetitePrivileged access reviews running lateTreatment plan60%
  • RSK-2027-009MediumWithin appetiteSingle vendor for security monitoringTreatment plan80%
Critical vulnerabilities open more than 30 days7Breach · re-assessment triggeredThreshold 5
Technology risk register

Risk register

Raise, assess, treat and report technology risks against your own risk standard.

  • Inherent, residual and target ratings on your matrix
  • Appetite limits with automatic escalation
  • Key risk indicators, heat maps and the committee pack
Assessment cycles / 2027 annualAcme Organization
2027 annual compliance assessment · schedule
Plan and approvePrepare controlsLine manager reviewSecond-line reviewCompliance validationClose the cycle
Critical pathMilestoneToday
2027 annual compliance assessment · schedule

Assessment cycles

Plan a cycle in five steps and follow it to the close.

  • Periodic, ad hoc, edition gap, audit follow-up and evidence renewal cycles
  • A schedule with phases, milestones, dependencies and the critical path
  • Coverage for each part of the organization, detected then confirmed
Governance / ActionsAcme Organization
ActionOwnerDueState
SBP-2027-0142Close finding on backup restore timeHead of InfrastructureNov 30Open
SBP-2027-0137Approve data classification for the HR systemData governance leadNov 20Slipped 1×
SBP-2027-0129Renew the SOC monitoring contractProcurement leadDec 15In progress
SYNC-2027-0041Move backups to an in-Kingdom regionDecided in the weekly sync · Oct 28
Governance

Leadership office

Decisions, actions, contracts and plans on the same platform.

  • Decisions registered from email and decided in the meeting
  • Actions with owners, due dates and slips
  • Contracts, planning, relationships, correspondence and availability
  • Decisions
  • Actions
  • Contracts and vendors
  • Planning
  • Relationships
  • Correspondence
  • Availability

See CIYAJ against your own frameworks.

Tell us which frameworks are in scope and we will arrange a walkthrough with your team.

Request a briefing