One record for every control, owner, evidence file and review.
CIYAJ brings the NCA, SDAIA and NDMO framework library, the people who own each control, the evidence that proves it and the reviews that validate it into one record, with grades and history on top.
01Library and applicability37 frameworks with their official text. CIYAJ works out which apply to which parts of your organization, and says why.
02Owners and coverageEvery control has an owner, contributors and the parts of the organization it must reach.
03EvidenceDeliverables proven by files. CIYAJ reads each file as it is uploaded and fills in what it can.
04Review and validationLine manager, second line and the Compliance team review in turn, in the app or by email.
05Scores and historyGrades, three measures and every control's result in every cycle.
06Actions and assuranceCorrective actions, exceptions, control testing and attestation campaigns.
How it works
From the regulator's text to a verified result.
The CIYAJ model
01NCA · SDAIA · NDMORegulators
0237 frameworksWith their official text
031,300+ requirementsLinked across frameworks
04Your controlsCommon controls answer many
05Owners and coverageEach part of the organization
06EvidenceRead on upload, renewed on time
07Review chainOwner to Compliance
08ResultsGrades and three measures
Every gapCorrective actions with owners and dates, or an exception with an expiry
A cycle, step by step
01ScopeCIYAJ works out which frameworks and requirements apply to each part of your organization, and the cycle owner confirms the coverage.
02PrepareOwners rate each control, record its coverage and attach the deliverables that prove it.
03ReviewThe line manager and the second line approve or return. The Compliance team reads the assessor's story and writes a conclusion.
04MeasureGrades and the three measures update as controls are validated, with the history of every cycle.
05Keep it currentCorrective actions are closed and verified, evidence is renewed and owners confirm controls between cycles.
Modules
Each module licensed on its own, all on one record.
Start with Compliance and add the next module without a new set-up. People, organization and evidence are shared.
Illustrative data
Assessment cycles / 2027 annualAcme Organization
2027 annual compliance assessment · schedule
Plan and approvePrepare controlsLine manager reviewSecond-line reviewCompliance validationClose the cycle
Critical pathMilestoneToday
2027 annual compliance assessment · schedule
Assessment cycles
Plan a cycle in five steps and follow it to the close.
Periodic, ad hoc, edition gap, audit follow-up and evidence renewal cycles
A schedule with phases, milestones, dependencies and the critical path
Coverage for each part of the organization, detected then confirmed
Assurance / ExceptionsAcme Organization
Likelihood
5
1
4
1
2
1
3
1
3
1
2
1
2
1
1
1
1
1
2
3
4
5
Impact
EXC-2027-004HighEndpoint agent missing on legacy OT workstationsCompensating: Network isolation · Expires: Dec 31, 2027
EXC-2027-007MediumAnnual penetration test moved to Q3Compensating: Quarterly scans · Expires: Sep 30, 2027
EXC-2026-019HighShared admin account on a legacy systemCompensating: Session recording · Expires: in 21 days
Exceptions
Exceptions and risk acceptance
Accept a risk openly, for a stated time, instead of hiding a gap.
Reason, compensating controls, a 5×5 risk level, approval and expiry
An exception explains a gap; it never changes a rating
Expiring exceptions are flagged in the daily notices
Policies / Controlled documentsAcme Organization
Number
Document
Stage
Next review
POL-001
Information Security Policy
Published
Mar 2027
STD-014
Access Control Standard
Quality check
—
PRO-022
Backup and Restore Procedure
Approved
Jan 2028
PRO-031
Personal Data Breach Response Procedure
Draft
—
STD-014 meets 9 obligations across ECC-2:2024 and CCC-2:2024.
Policies
Policies
Plan, write, review, approve, publish and retire controlled documents.
Approval routes that start with a quality check by a document controller
Content fingerprinted, so a change after approval stops the document
Signatures through DocuSign and a register of what is in force
Governance / ActionsAcme Organization
Action
Owner
Due
State
SBP-2027-0142Close finding on backup restore time
Head of Infrastructure
Nov 30
Open
SBP-2027-0137Approve data classification for the HR system
Data governance lead
Nov 20
Slipped 1×
SBP-2027-0129Renew the SOC monitoring contract
Procurement lead
Dec 15
In progress
SYNC-2027-0041Move backups to an in-Kingdom regionDecided in the weekly sync · Oct 28
Governance
Governance
The leadership office and the PMO on the same platform.
Decisions registered from email and decided in the meeting
Actions with owners, due dates and slips
Contracts, planning, relationships, correspondence and availability
Decisions
Actions
Contracts and vendors
Planning
Relationships
Correspondence
Availability
Automation
The follow-up runs itself.
CIYAJ sends every assignment, reminder and approval request on its own, chases what is late and collects the answers. Nobody has to remember to follow up.
CIYAJSpots what is due and who owes it
Sent automaticallyAssignments, reminders and escalations
People actApprove or return in the portal or by email
Record updatedAnswer verified, trail kept
Every working morning, until the work is done
Every notice sent for youAssignments, review requests, returns, validations and renewals go out automatically. A notice that fails can be sent again.
Approve wherever suits youReviewers approve or return in the CIYAJ portal or straight from their email. CIYAJ applies an answer only after checking who answered, that they were asked and that the request is still current.
One reminder a day, not tenReminders before a step is due and escalations when it is overdue, grouped into one message per person each working morning.
Evidence that stays currentRenewal notices before files expire. Expired evidence is marked, and the current-evidence measure moves with it.
Test first, then liveRun every notice to a test address first. Switch to Live when you are ready.
Procedures you controlEdit the procedures and review chains in CIYAJ. Publishing a new version changes what happens next.
What people receive
CIYAJ · approval request
Review ECC 2-2-3: Multi-factor authentication
Submitted by the control owner with 3 evidence files. Due tomorrow.
ApproveReturn
Your CIYAJ items for todaySunday · 7:00
2 reviews due tomorrow
1 control overdue by 2 working days
3 evidence files expire within 30 days
Open my work
Across the governance modules, CIYAJ also files incoming email into the right register, sends documents and letters for e-signature, and sends weekly digests.
See CIYAJ against your own frameworks.
Tell us which frameworks are in scope and we will arrange a walkthrough with your team.
