Governance

Govern by documents people can find, follow and prove.

Plan, write, review, approve, publish and retire every policy, standard, procedure and SOP, and run the leadership office's decisions, actions, contracts and plans on the same record.

The life of a controlled document

  1. 01Bring in
  2. 02Plan
  3. 03Write
  4. 04Review and approve
  5. 05Publish
  6. 06Communicate
  7. 07Monitor
  8. 08Keep current
Illustrative data
Policies / Controlled documentsAcme Organization
NumberDocumentStageNext review
POL-001Information Security PolicyPublishedMar 2027
STD-014Access Control StandardQuality check—
PRO-022Backup and Restore ProcedureApprovedJan 2028
PRO-031Personal Data Breach Response ProcedureDraft—

STD-014 meets 9 obligations across ECC-2:2024 and CCC-2:2024.

Policies

What Governance does

  • Bring existing documents inCIYAJ reads PDF, Word, PowerPoint, Excel and scanned files, proposes each one's type, place in the plan and obligations, scores its health and lists its gaps.
  • A document plan by domain and processEvery planned document has its place, owner and template, and a first draft fills in from the template.
  • Review routes that start with qualityApproval routes start with a quality check by a document controller and end with e-signature. A change after approval stops the document.
  • One register of what is in forceOnly the publications register decides what is in force. Every document carries its classification, version and next review.
  • A policy portal for everyoneEvery document in force on one page with a news line, updated automatically when documents are published, linked or retired.
  • Acknowledgement and re-attestationCampaigns ask people to read and acknowledge, with reminders, champions and a leaderboard.
  • Second-line documents linked inLink the enterprise and cybersecurity repositories. A document controller accepts each file, and changes are checked daily.
  • Obligations coveredEach document lists the NCA, NDMO, PDPL and SDAIA obligations it meets, and feeds evidence to compliance.
  • Effectiveness you can measureKPIs with targets, a non-compliance log, an effectiveness scorecard and process maturity.

The leadership office on the same record

Decisions registered from email and decided in the meeting, actions with owners and due dates, contracts and vendors, planning, relationships, correspondence and availability.

  • Decisions
  • Actions
  • Contracts and vendors
  • Planning
  • Relationships
  • Correspondence
  • Availability
Illustrative data
Governance / ActionsAcme Organization
ActionOwnerDueState
SBP-2027-0142Close finding on backup restore timeHead of InfrastructureNov 30Open
SBP-2027-0137Approve data classification for the HR systemData governance leadNov 20Slipped 1×
SBP-2027-0129Renew the SOC monitoring contractProcurement leadDec 15In progress
SYNC-2027-0041Move backups to an in-Kingdom regionDecided in the weekly sync · Oct 28
Governance

See CIYAJ against your own frameworks.

Tell us which frameworks are in scope and we will arrange a walkthrough with your team.

Request a briefing