Governance · Risk · Compliance

Know exactly where you stand, control by control.

UIS Compass scores your organisation 0–4 against every control in 43 frameworks — with the written evidence an auditor will ask for, and the gap list to close before they do.

43 frameworks
1,401 controls
0–4 maturity per control
EN · AR throughout
A.5.1 ISO/IEC 27001

Policies for information security

Level 1 — Managed

Pick the highest level where every statement is true. When in doubt, score lower.

One scale, every framework

Five levels. No half marks.

Every control in every framework is scored on the same ladder, so a score means the same thing whether you are reading ISO 27001 or NCA ECC.

0
Initial

Nothing in place. Decisions made case by case, with nothing written down.

1
Managed

Something exists but it is informal, undated, and known only to the people who wrote it.

2
Defined

Documented, approved, and communicated. An auditor can be shown it.

3
Quantified

Measured and reviewed on a cycle. You can prove it is followed, not just published.

4
Optimising

Embedded in how the organisation runs, and improved on evidence rather than opinion.

Coverage

43 frameworks, one assessment engine.

Saudi and GCC regulation alongside the ISO management systems and the international security standards — scored the same way, cross-mapped where controls overlap.

43 frameworks
1,401 controls
EN · AR on every one

11 frameworks

Cybersecurity & data protection

  • NCA ECC-2:2024 Essential cybersecurity controls
  • ISO/IEC 27001 Information security
  • Saudi PDPL Personal data protection law
  • ISO/IEC 27701 Privacy information management
  • SAMA CSF Saudi Central Bank framework
  • SOC 2 Trust services criteria
  • PCI DSS 4.0.1 Payment card data security
  • GDPR General data protection regulation
  • NCA OTCC Operational technology controls
  • NIST CSF 2.0 Cybersecurity framework
  • NCA DCC Data cybersecurity controls
5 frameworks

Data, AI & digital government

  • DGA Digital transformation standards
  • NDMO National data management
  • ISO/IEC 42001 AI management systems
  • SDAIA AI Ethics AI ethics principles
  • NAII National AI index
8 frameworks

Management systems

  • ISO 22000:2018 Food safety
  • ISO 22301:2019 Business continuity
  • ISO 45001:2018 Occupational health & safety
  • ISO 9001:2015 Quality management
  • ISO 50001:2018 Energy management
  • ISO 14001:2015 Environmental management
  • ISO 55001:2014 Asset management
  • HACCP Codex Alimentarius
8 frameworks

Human capital & organisation

  • CIPD Profession map
  • SHRM BASK Body of applied skills
  • Great Place To Work Workplace culture
  • Gallup Q12 Employee engagement
  • ISO 30414 Human capital reporting
  • ISO 30415 Diversity & inclusion
  • ISO 30405 Recruitment
  • ISO 30409 Workforce planning
4 frameworks

Risk, control & compliance

  • ISO 37001:2016 Anti-bribery
  • ISO 37301:2021 Compliance management
  • COSO ERM 2017 Enterprise risk management
  • COSO IC 2013 Internal control
4 frameworks

Sustainability & ESG disclosure

  • GRI Standards Sustainability reporting
  • Saudi Exchange ESG Disclosure guidelines
  • IFRS S1 & S2 Sustainability & climate disclosure
  • UN SDGs Sustainable development goals
3 frameworks

IT & service management

  • ISO/IEC 20000-1:2018 Service management
  • COBIT 2019 IT governance
  • ITIL Version 5 Service management

What you walk away with

A score you can defend in the room.

A number on its own invites argument. Every score in UIS Compass carries the statement it was measured against and the evidence behind it.

Evidence

What an auditor asks for

Each control lists the specific artefacts an assessor will request — and where a template exists, you can download it.

  • Required evidence, per control
  • Bilingual Word and Excel templates
  • Local pre-check, no upload needed
  • Optional AI scoring from your evidence
Roadmap

The gaps, in the order to close them

Scores become a prioritised plan — weighted by control importance, not just by what scored lowest.

  • Quick wins separated from core uplift
  • Owners and due dates in the tracker
  • Risk register and audit findings
  • Re-assess and see the movement
Exports

Reports that match the screen

What you present is what you assessed. No rebuilding the story in a slide deck the night before.

  • PDF, PowerPoint and Excel
  • Cross-framework mapping
  • Read-only client share links
  • Arabic and English throughout

Plans

Two ways to buy, depending who you are assessing.

Every plan includes the whole platform and all 43 frameworks. Contact us for pricing.

Free
$0

No card, no time limit

Try the platform on a trial framework.

  • Trial framework, partial roadmap
  • PDF export
  • Guided and expert scoring
Start free
Growth
Contact us for pricing

A team assessing a few frameworks.

  • Full assessment, 3 frameworks
  • Roadmap and implementation tracker
  • Evidence checklists, PDF and Excel
Contact us
Most chosen
Professional
Contact us for pricing

A full compliance programme for one organisation.

  • Full assessment, up to 6 frameworks
  • Cross-framework mapping
  • Board reports and AI evidence scoring
Contact us
Enterprise
Contact us for pricing

Large or regulated organisations

Everything in Professional, without limits.

  • Unlimited frameworks and organisations
  • Dedicated UIS consultant and workshop
  • Team training, unlimited AI scoring
Contact us

Score one control and see how it reads.

The trial covers ten controls with no account needed.

Open UIS Compass