GRC Platform
Compliance, risk and vendors in one place
Run compliance frameworks, control assessments, evidence, the risk register and third-party risk from one platform, with overlapping controls mapped so a single piece of evidence satisfies more than one standard.
Rating zones, colours and labels are configurable
Five modules that work together
Framework & Control Library
Frameworks, domains and controls, mapped to each other
Compliance Assessments
Assignment, evidence, review and weighted scoring
Evidence Management
Upload once, link across many controls
Risk Register
5×5 matrix, treatment and e-signed acceptance
Vendor Risk
Vendor lifecycle, questionnaires and continuous monitoring
Compliance Framework & Control Library
One compliance library for every standard your organisation answers to.
- Full framework library: create, clone, enable or disable, with NCA ECC built in and ready to use
- Import any other framework, such as SAMA CSF or ISO 27001, from CSV or JSON
- Framework → Domain → Control hierarchy, with parent and child controls
- Unified Control List (UCL): pick one framework as the canonical set and map every other framework's controls onto it
- Cross-framework control references
Example of unified mapping
Compliance Assessments
From assigning a control to approving it, with a clear path for everyone involved.
Create the assessment
Assess against any framework and assign controls individually or in bulk. Mark controls Not Applicable, and restore them later if needed.
Employees upload evidence
A self-service employee portal: task list, control detail, evidence upload, then submit or withdraw.
Admins review
Review each control, approve or reject it, and record its score.
Weighted scoring
Per-control weight × score rolls up to domain and assessment level, with Not Applicable controls excluded from the calculation.
Full audit trail for every assessment and every control.
Evidence Management
One piece of evidence, many controls.
Central evidence library
Manageable categories, with evidence moved between categories and bulk delete.
Upload once, link to many
Upload directly to a control, or upload once and link or unlink the evidence across as many controls as you need.
Reuse suggestions
The platform surfaces evidence already collected for controls that share the same UCL mapping, cutting duplicate uploads.
Risk Register
From identifying a risk to closing it, through a documented workflow.
Risk workflow
Each transition is scoped to the right actor: the admin or the assigned recipient.
Configurable 5×5 matrix
Likelihood × impact with English and Arabic labels, configurable rating zones and colours, tuned toward NCA NFCRM-style reporting.
Risk appetite and treatment SLAs
Configurable appetite and tolerance thresholds, plus treatment SLA days for each severity level.
Three registers
A primary register, an ad-hoc register and an assessment-only register.
AI-assisted risk scenarios
Enter the asset, threat and vulnerability to get a draft title and description in English and Arabic, with suggested likelihood and impact and the rationale behind them. Reusable scenario templates included.
Documented treatment
The assigned recipient submits the treatment with evidence and the admin reviews it, with a full history of workflow events.
E-signed risk acceptance
Multi-level approval that depends on the risk rating, capturing signature, justification, conditions, expiry and review date. The risk is marked accepted automatically once every required level has signed.
Risk assessment workshops
Scoped workshops whose identified risks can be promoted into the main register.
Control to risk escalation
Turn a weak or failed control into a tracked risk in the register.
Dashboard analytics
Counts by status, register and workflow state, overdue treatments, and a heat map of the matrix.
Third-Party / Vendor Risk Management (TPRM)
Continuous visibility into third-party risk, from prospect to termination.
Vendor lifecycle
With an approval sign-off step, and the option to reject or reopen.
Vendor registry
A registry of vendors and their contacts, with fourth-party and sub-processor tracking per vendor.
Inherent risk scoring
Data classification × access level × business criticality, with configurable weights, sets the vendor's tier.
Residual tiering that can't hide risk
The worse of two: the inherent score discounted by demonstrated control effectiveness (capped at 50%), or the worst open risk linked to the vendor. A good questionnaire can never mask a live critical risk.
External vendor portal
Questionnaire assessments against configurable frameworks, served through a dedicated portal with secure magic-link access. Vendor contacts only ever see their own portal.
Continuous monitoring
A daily scan raises alerts for upcoming reassessments, contract renewals and expiring evidence or certificates within a horizon you set.
From alert to action
Acknowledge, dismiss or escalate an alert straight into the risk register. A critical alert can automatically start a new vendor reassessment questionnaire.
Tenant-wide settings: tier thresholds, labels and colours, reassessment cadence per tier, scoring weights, and the required framework per tier.
Built for the enterprise
Per-tenant isolation
Each tenant has its own database and settings.
English and Arabic
Bilingual content across frameworks, risk labels and notifications.
A notification for every event
Control or risk assigned, treatment submitted and reviewed, acceptance signed, vendor questionnaire assigned, certificate expiring, alert raised.
Full audit logging
Every action on the platform is recorded in the audit log.
See the GRC platform in action
Compliance, evidence, risk and vendor risk in a single demo.
Request a Demo