CIYAJ سياج
العربية
Menu
Request a briefing

Compliance

Every control NCA, SDAIA and NDMO require, proven.

37 frameworks with their official text, owners and coverage, evidence read on upload, a review chain, grades and three measures, and a read-only Audit Room for assessors.

  • 01Library and applicability37 frameworks with their official text. CIYAJ works out which apply to which parts of your organization, and says why.
  • 02Owners and coverageEvery control has an owner, contributors and the parts of the organization it must reach.
  • 03EvidenceDeliverables proven by files. CIYAJ reads each file as it is uploaded and fills in what it can.
  • 04Review and validationLine manager, second line and the Compliance team review in turn, in the app or by email.
  • 05Scores and historyGrades, three measures and every control's result in every cycle.
  • 06Actions and assuranceCorrective actions, exceptions, control testing and attestation campaigns.

For assessors

One place for the assessor to see everything.

The Audit Room shows a cycle as it stands, domain by domain and control by control, read-only. Internal assessors and external auditors work from the same record the organization works in.

Illustrative data
Assurance / Audit RoomAcme Organization
Assurance · read-onlyAudit RoomExport workbookDraw a test sample
2027 annual assessmentECC-2:2024ValidatedSelf-assessed
Main controls108
Compliance index79.5%Substantial
With evidence97%105 of 108
Evidence files266
ImplementedPartiallyNot implementedN/ANot yet rated
1Cybersecurity governance
1-1Cybersecurity strategy
1-1-1Strategy defined and approved
1-1-2Roadmap to execute the strategy
2Cybersecurity defense
2-2Identity and access management
2-2-3Multi-factor authentication
2-2-4Privileged access
2-2-5Periodic access reviews
2-2-3ECC controlImplemented
Multi-factor authentication for remote accessOfficial text and links
OwnerHead of IdentityStageValidatedCoverage6 of 6 parts
Assessor's story

Remote access to all six parts in scope asks for a second factor. Filed: the access control policy, the configuration export and the Q1 access review.

Conclusion

Implemented. Policy, configuration and review agree. No exception stands.

Approval trail
  • SubmittedControl ownerMar 2
  • ApprovedLine managerMar 4
  • ApprovedHead of CybersecurityMar 6
  • ValidatedComplianceMar 9
Evidence
  • Access control policy v3.pdf
  • Remote access configuration.xlsx
  • Q1 access review.pdfAbove your ceiling
TestsOperating effectiveness · sample 5 of 48 · Effective
Audit Room
01Everything for each controlThe rating, coverage, the assessor's story and conclusion, the approval trail, evidence, exceptions and tests.
02Read-only by designAssessors see, they cannot change. Files above their classification ceiling are listed but cannot be opened.
03Only what they may seeEach person sees only the frameworks the access matrix allows.
04External access that endsThe External Auditor role carries an end date. After it, the role gives nothing.
05Samples you can reproduceDraw a test sample, or test design and operating effectiveness on samples a reviewer can draw again.
06The NCA workbook, exportedSave the NCA workbook for the chosen cycle and framework.

Dashboards

Know where you stand, and prove how you got there.

Every figure counts from the controls behind it, and every chart opens the record it summarizes.

Illustrative data

Grades

0507590100
  • Initialbelow 50
  • Developing50 to 74.9
  • Substantial75 to 89.9
  • Advanced90 and above

A framework is capped at Substantial while any main control is Not implemented, so a high average never hides a gap.

Where compliance stands

Each main control, under three measures side by side.
By cycles80.5%SubstantialEach control's latest validated result
By aging79.5%Substantial · 6 not countedOnly results still within the review period
By current evidence54.5%DevelopingDeliverables proven today by in-date files
In date 99Due soon 3Out of date 6Never assessed 0

How it has moved

The index at the end of each month, under each measure.
0255075100NovJanMarMayJulSepOct
By cyclesBy agingBy current evidence

Where the work is

Main controls by review stage, within or past the stage time.
116Owner preparing
16Line manager
29Second line
15Compliance validation
Within the stage timeOverdue

Every control, every cycle

The validated result of each main control in each cycle.
20242025202620271-1-11-1-21-2-12-1-12-2-32-2-42-2-52-3-33-1-14-1-1
ImplementedPartially implementedNot implementedNot applicableNot yet rated

By domain

ECC-2:2024, validated results in the 2027 cycle.
  • 1Cybersecurity governance84.2%
  • 2Cybersecurity defense77.9%
  • 3Cybersecurity resilience81.0%
  • 4Third-party and cloud cybersecurity72.4%
The mark at 75 is where Substantial begins.

How it works

From the regulator's text to a verified result.

The CIYAJ model
  1. 01NCA · SDAIA · NDMORegulators
  2. 0237 frameworksWith their official text
  3. 031,300+ requirementsLinked across frameworks
  4. 04Your controlsCommon controls answer many
  5. 05Owners and coverageEach part of the organization
  6. 06EvidenceRead on upload, renewed on time
  7. 07Review chainOwner to Compliance
  8. 08ResultsGrades and three measures
Every gapCorrective actions with owners and dates, or an exception with an expiry
A cycle, step by step
  1. 01ScopeCIYAJ works out which frameworks and requirements apply to each part of your organization, and the cycle owner confirms the coverage.
  2. 02PrepareOwners rate each control, record its coverage and attach the deliverables that prove it.
  3. 03ReviewThe line manager and the second line approve or return. The Compliance team reads the assessor's story and writes a conclusion.
  4. 04MeasureGrades and the three measures update as controls are validated, with the history of every cycle.
  5. 05Keep it currentCorrective actions are closed and verified, evidence is renewed and owners confirm controls between cycles.

Cycles and exceptions

Assessment cycles / 2027 annualAcme Organization
2027 annual compliance assessment · schedule
Plan and approvePrepare controlsLine manager reviewSecond-line reviewCompliance validationClose the cycle
Critical pathMilestoneToday
2027 annual compliance assessment · schedule

Assessment cycles

Plan a cycle in five steps and follow it to the close.

  • Periodic, ad hoc, edition gap, audit follow-up and evidence renewal cycles
  • A schedule with phases, milestones, dependencies and the critical path
  • Coverage for each part of the organization, detected then confirmed
Assurance / ExceptionsAcme Organization
Likelihood
5
1
4
1
2
1
3
1
3
1
2
1
2
1
1
1
1
1
2
3
4
5
Impact
  • EXC-2027-004HighEndpoint agent missing on legacy OT workstationsCompensating: Network isolation · Expires: Dec 31, 2027
  • EXC-2027-007MediumAnnual penetration test moved to Q3Compensating: Quarterly scans · Expires: Sep 30, 2027
  • EXC-2026-019HighShared admin account on a legacy systemCompensating: Session recording · Expires: in 21 days
Exceptions

Exceptions and risk acceptance

Accept a risk openly, for a stated time, instead of hiding a gap.

  • Reason, compensating controls, a 5×5 risk level, approval and expiry
  • An exception explains a gap; it never changes a rating
  • Expiring exceptions are flagged in the daily notices

See CIYAJ against your own frameworks.

Tell us which frameworks are in scope and we will arrange a walkthrough with your team.

Request a briefing