العربيةLog inBook a demo
Log inBook a demo

Built for Saudi compliance

Comply once. Prove everywhere.

التزام واحد، إثبات في كل إطار

Salis GRC is one platform for compliance, enterprise risk management (ERM) and governance. Your controls and evidence sit beside the regulators' frameworks, and your risks can be costed in SAR. It works in Arabic and English, in your own environment.

Book a demo Log in
The Salis GRC dashboard for your organisation: overdue items, open gaps, evidence validity, and readiness against NCA ECC-2 and ISO 27001.

Screens from the platform, with sample data.

In the framework library

  • NCA Essential Cybersecurity ControlsECC‑2:2024 · official Arabic and English text
  • SAMA Cyber Security FrameworkOfficial Arabic and English text
  • Personal Data Protection LawPDPL · official Arabic and English text
  • ISO/IEC 27001:2022In our own wording, linked to NCA ECC-2 and SAMA

01 / Why it exists

The same questions, answered again and again

  1. 01

    Overlapping frameworks

    NCA, SAMA, PDPL and ISO ask similar questions, and each one gets its own spreadsheet.

  2. 02

    Scattered evidence

    Proof sits in email and shared drives, so showing one control means hunting for files.

  3. 03

    Deadlines in many places

    Every regulator has its own reporting clock, and contracts add notice periods of their own.

  4. 04

    Risks without a price

    When a risk has a colour but no cost, it is hard to say what to fix first.

02 / Our approach

One answer. Every framework.

Write each control once, in your own words, with its evidence attached. Then link it to every requirement it covers, whichever framework the requirement comes from.

03 / How it works

From the official text to proof

  1. 01

    Official texts

    NCA, SAMA and PDPL in their official Arabic and English text, and ISO/IEC 27001 linked to both NCA and SAMA.

  2. 02

    Your controls

    You write them in your own words and link each one to the requirements it covers.

  3. 03

    Evidence

    Each file gets a fingerprint and a validity date, and counts wherever its control counts.

  4. 04

    Assessments

    Answer each framework requirement by requirement and see which gaps remain.

  5. 05

    Proof

    One control and its evidence answer for every framework it is linked to.

04 / What it does

One system for the work regulators ask for

Answer once

Write a control once and use it wherever it applies

Link a control to the requirements it covers in any framework. Its evidence goes with it, so you upload each file once.

  • In this exampleOne incident-response control answers seven requirements, four in NCA ECC-2 and three in ISO 27001, and the same evidence backs all seven.
  • Approved linksAn administrator approves each link between a control and a requirement.
One control, linked to two frameworks
Company control CTL-002, Incident response and regulator notification, linked to 7 requirements: NCA ECC 2-13-1, 2-13-3-1, 2-13-3-2 and 2-13-3-3, and ISO 5.24, 5.25 and 5.26.
Its evidence counts wherever the control does
An evidence file's coverage: linked through controls to 7 requirements across 2 frameworks, NCA ECC and ISO/IEC 27001.

Evidence

Evidence that shows when it expires

Upload a file once and link it to every control it proves. The platform stores its fingerprint and where it came from, and marks it as expiring when its date gets close.

  • Tamper-evidentEach file gets a SHA-256 fingerprint, so any later change shows.
  • Valid until a dateCurrent, then expiring in the last quarter of its validity (at most its last 60 days), then expired and due to be collected again.
Every file counts until a date
Evidence counts: 14 in the register, 12 current, 0 expiring, 2 expired.
One file, with its fingerprint, date and control
A tabletop-exercise file with its fingerprint and a link to download it.

Incidents

One incident, each regulator's clock

Log the incident once. From your company's profile, the platform raises the reporting duty for each regulator that applies, and starts each clock from its own trigger event.

  • Recorded, not sentThe platform records that a regulator was notified, and when. It does not send the report for you.
  • Working daysCST's final report is due 20 working days after the response closes, counting Friday and Saturday as the weekend. Public holidays are not skipped, so check any date near Eid.
  • Not applicable, with a reasonWhen a duty doesn't apply, the Head closes it and the reason is kept.
CST's final report, counted in working days
CST's final report: 20 working days after the response closed, with its due date in both calendars; Saudi public holidays are not modelled.
No personal data involved: SDAIA's duty closed, with the reason
SDAIA's 72-hour notice, marked not applicable because no personal data was involved.
  • Progress against NCA's Essential Cybersecurity Controls: 28 implemented, 17 partially implemented, 7 not implemented; 52 of 200 reviewed.

    See where you stand, framework by framework

    Each framework has its own assessment, showing every requirement, its answer, who is answering it and the gaps that remain. You can import and export a workbook in the layout of NCA's ECC-1 assessment tool.

  • A department's operational limit: a residual score of 9 and an expected yearly loss of SAR 30,000. The outage risk, at 12 and SAR 34,499.27, shows Breached.

    Enterprise risk management, priced in riyals

    Each risk has a department and an owner, and is scored for likelihood and impact before and after controls. Its cost in SAR can be a fixed estimate, a range or a Monte Carlo simulation. Each department's Head sets a limit, and any risk above it shows as Breached.

  • Approval history: version 2 approved by the Head of Risk Management, after its owner submitted it.

    Approved by the right person

    Policies and procedures are kept in Arabic and English, with every version. The department's Head approves them, but never a version they wrote or submitted, and staff confirm they have read the one in force.

  • A task's discussion: the security analyst mentions the compliance manager to say the first draft of a report is ready for review.

    Every department owns its part

    Everyone has one list of what is waiting on them. Type @ to bring in a colleague. The person who assigned a task confirms when it is done.

  • October 2026 in the calendar, with its Hijri month: task deadlines and an obligation review, each dated in both calendars.

    Every commitment, in both calendars

    Obligations from regulators, laws and contracts sit in one register, each with an owner and a review date. Every item in the calendar shows its date in Hijri and Gregorian.

  • One person, several hats

    There are six roles: Administrator, Compliance, Governance, Risk, Auditor and Employee. In each department a person is a Viewer, Member or Head, and the Head makes the department's decisions. Auditors can read every area except Settings, and cannot change anything.

05 / In numbers

Built on the regulators' own texts

  • 200answerable NCA ECC-2 items in one assessment
  • 23reporting rules from Saudi and EU regulators, each timed from its own trigger event
  • 3official texts in Arabic and English, for NCA, SAMA and PDPL
  • 2calendars, Hijri and Gregorian, on every deadline and review date

06 / Capabilities

What's in Salis GRC

Compliance, enterprise risk management (ERM) and governance share one workspace. A tag on an item means it depends on a pilot, on your installation, or on your licence.

Workspace 5

  1. 01DashboardOverdue items, open gaps, evidence validity and readiness per framework, with snapshots over time.
  2. 02My workEverything waiting on a person, shown as a list or a board.
  3. 03DepartmentsOne page per department with its work, controls, risks, incidents, policies and people. The Head makes the department's decisions.
  4. 04CalendarEight kinds of dated item, in Hijri and Gregorian, overdue first.
  5. 05DiscussionComments and @mentions on tasks, risks, policies, incidents and assessment answers, with an activity timeline and in-app notifications.

Compliance 8

  1. 06Framework libraryNCA ECC-2:2024, SAMA CSF and PDPL in their official Arabic and English text, ISO/IEC 27001:2022 in our own wording, and approved crosswalks between them.
  2. 07AssessmentsNCA's four answer options, delegation to departments, answer reuse, and a workbook you can import and export in the layout of NCA's ECC-1 tool.
  3. 08ControlsEach control is linked to the requirements it covers, and an administrator approves every link.
  4. 09Gap analysisPick a framework and see which requirements your controls cover fully, partly or not at all. Only approved links count.
  5. 10EvidenceEvery file gets a SHA-256 fingerprint and a validity date, and shows which frameworks it covers.
  6. 11RemediationEach open gap with its plan, owner, actions and target date. Overdue plans come first.
  7. 12SAMA maturityMaturity levels from 0 to 5, capped by the evidence behind them.
  8. 13MonitoringConnectors built and tested against simulated systems. Connecting them to your own systems, and proving they work, happens in a pilot.Connected in a pilot

Enterprise risk management (ERM) 5

  1. 14Risk registerEvery risk has a department and an owner. Likelihood and impact sit on a 5 × 5 matrix with inherent and residual scores, and risks show on the department pages and the dashboard.
  2. 15Cost in riyalsA fixed estimate, a range or a Monte Carlo simulation, with a penalty library of regulator fines.
  3. 16Treatments and acceptancesGive a treatment a named owner and it becomes their task. Risk acceptances are recorded.
  4. 17Risk limitsEach department's Head sets the highest residual score and expected yearly loss it will accept. A risk above that limit shows Breached.
  5. 18Key risk indicatorsDated readings checked against amber and red thresholds, for early warning.

Governance 5

  1. 19PoliciesArabic and English in one document. Every version is kept, and any two can be compared.
  2. 20ApprovalsThe department's Head approves each version, but never one they wrote or submitted.
  3. 21AcknowledgementsStaff confirm they have read the version in force.
  4. 22ObligationsWhat regulators, laws and contracts require, in one register with owners and review dates.
  5. 23IncidentsEach regulator's reporting duty with its own clock. A duty that doesn't apply is closed with a reason, and each incident keeps a communication log and its costs.

Platform 7

  1. 24Roles and accessSix roles, plus a Viewer, Member or Head level on each department. Everyone has a My access page.
  2. 25Arabic firstEvery screen in Arabic, right to left, with English one click away.
  3. 26Audit trailChanges are recorded in a hash-chained trail that shows any tampering.
  4. 27Search and setupSearch across controls and evidence, a setup guide and short tours.
  5. 28EmailReminders and a daily digest through your own mail server.Set up per install
  6. 29Hand-offWhen a monitored control fails, the platform can open a ticket in Jira or ServiceNow and post a message in Slack or Teams. Tested against simulated systems.Set up per install
  7. 30Your logoYour logo beside the Salis GRC mark, on every page of the platform and on the sign-in page.Licence option

07 / Arabic first

Arabic first. English one click away.

Every record has the same fields in both languages, and Arabic reads right to left. Each person picks their own language, and the record and its history are the same in either.

  • Hijri and GregorianCalendar, review and deadline dates show in both calendars.
In Arabic
A risk record in Arabic, laid out right to left, with its status, response and owner.
In English
The same risk record in English, with its status, response and owner.

08 / Deployment

Runs in your own environment

  • Your own server

    The platform installs on one server that you run, using Docker and an installer.

  • Backup and restore

    A single command backs everything up, and another restores it. The restore is tested automatically.

  • A licence with no kill switch

    The licence is a signed file, checked offline. If it lapses, the platform becomes read-only after a grace period. It is never switched off remotely.

  • Sign-in and separation

    Sign-in has account lockout and a password policy, and two-step sign-in is available. Each organisation's data is kept separate in the database.

09 / Videos

Watch Salis GRC

Filmed in the platform with sample data. Captions are on screen, so no sound is needed.

  • Salis GRC full walkthrough

    About 9 minutes, in 8 chapters

Pressing play loads the video from YouTube.

See Salis GRC on your own frameworks

Tell us which frameworks you answer to, and we'll walk you through the platform on our demonstration workspace.

Book a demo

Or write to [email protected]