X.Qiyas Logo

Digital Compliance & Governance Platform

Compliance you can see at any point in the cycle

X.Qiyas turns a set of standards into a managed operation: controls are assigned to owners, evidence is captured against them, validation is recorded, readiness is measured continuously and improvement is tracked between cycles.

See compliance run as a processRequest a demo

X.Qiyas dashboard, shown with sample data.

X.QiyasTalk to X-Shift
Readiness by domain Illustrative
READINESS BY DOMAIN Strategy & governance Digital services Data management Cybersecurity Digital capabilities Innovation Scored continuously, not at the submission window CONTROL Access rights are reviewed each quarter Owner assigned Validated Department Information Technology Due Within the cycle Reviewed by the named owner, with the reviewer recorded EVIDENCE CHAIN Access review register Produced by the owner Approval record Signed within the cycle Exception log Two accepted, both dated

A representative view of the X.Qiyas interface, built from the product’s own model.

Start here

Where compliance programmes usually begin

A compliance platform delivers value only once the control model underneath it is sound. If you are not yet certain what your obligations are or who owns them, the advisory route is the more cost-effective place to start.

We learn our readiness only when we are assessed.Nobody can state the position in the intervening months. Digital Compliance & MaturityWe understand the standards but cannot evidence compliance with them.Evidence is gathered by email in the weeks before submission.DGA Compliance AdvisoryOwnership of controls is assumed, not assigned.Accountability is discovered during the assessment, not before it.Digital Governance & Operating Model
Staying here?You are evaluating compliance platforms and need the module detail.

What it does

What X.Qiyas does

A standard remains a document until each control is owned, evidenced and shown to have been current. X.Qiyas is the operation that turns one into the other.

THE FAILURE IS RARELY THE EVIDENCE

Most entities hold it. What they cannot do is locate it, date it, or show who approved it.

01

The framework becomes structure

Perspectives, domains, controls and requirements configured as the framework defines them - alongside NORA, NCA, ISO or your own internal controls.

OutputA framework the platform understands
02

Every control gets an owner

Distributed to the department accountable for it, with a deadline, so the question of who is responsible has an answer before the assessment asks it.

OutputNamed accountability, not a shared folder
03

Evidence is collected against the control

Uploaded to the requirement it satisfies, versioned so the copy that applied during a cycle can still be produced afterwards.

OutputEvidence attached to what it proves
04

It is validated, not just filed

Multi-stage review with comments and rejection, and an audit trail that records who accepted what and when.

OutputEvidence that has been accepted
05

Readiness is visible all year

Scored continuously at control, domain and organisation level, so the position is known before the measurement cycle rather than assembled during it.

OutputA number leadership can state

The challenge

Compliance managed in spreadsheets is compliance discovered late

Most organisations know their standards. What they lack is an operating system for meeting them, so readiness becomes visible only when the assessment window opens.

HOW IT WORKS TODAY How it usually runs Requirements tracked in spreadsheets and folders Evidence collected by email before assessment Unclear ownership of individual controls No reliable view of readiness between cycles Audit trails reconstructed after the fact Readiness discovered when the window opens. WHAT IT BECOMES How X.Qiyas runs it Standards and controls as versioned records Each control owned with a due date Evidence attached to the control it satisfies Validation recorded by the reviewer Readiness visible continuously Readiness is a number, not a discovery.
HOW IT WORKS TODAY

How it usually runs

  • Requirements tracked in spreadsheets and folders
  • Evidence collected by email before assessment
  • Unclear ownership of individual controls
  • No reliable view of readiness between cycles
  • Audit trails reconstructed after the fact

Readiness discovered when the window opens.

WHAT IT BECOMES

How X.Qiyas runs it

  • Standards and controls as versioned records
  • Each control owned with a due date
  • Evidence attached to the control it satisfies
  • Validation recorded by the reviewer
  • Readiness visible continuously

Readiness is a number, not a discovery.

HOW IT WORKS TODAY How it usually runs Requirements tracked in spreadsheets and folders Evidence collected by email before assessment Unclear ownership of individual controls No reliable view of readiness between cycles Audit trails reconstructed after the fact Readiness discovered when the window opens. WHAT IT BECOMES How X.Qiyas runs it Standards and controls as versioned records Each control owned with a due date Evidence attached to the control it satisfies Validation recorded by the reviewer Readiness visible continuously Readiness is a number, not a discovery.

Frameworks

Every framework you are held to, in one place

Most entities are not measured against a single standard. They are measured against several, by different bodies and on different cycles, and the same piece of evidence usually satisfies more than one of them.

01

The DGA QIYAS framework

Perspectives, axes, standards and controls configured as the framework defines them, with each control mapped to the evidence types and validation procedure it expects.

and 2 more below

X.Qiyas Illustrative
FRAMEWORK The DGA QIYAS framework Active Overall progress 78% PERSPECTIVES 5 configured AXES 15 mapped STANDARDS 89 tracked CONTROLS 1,204 active CTRL-04.2 Ownership assigned and recorded QIYAS NORA ISO 27001 Owner Department head Evidence Policy · Approval Validated Framework illustrative

Your own controls

Internal policies and controls added beyond the public framework, governed with the same ownership, evidence and validation rules as the mandated ones.

Version history as frameworks change

Every change to a standard tracked over time, so when the framework is updated the platform moves with it instead of requiring a manual remapping exercise.

Platform model

The compliance cycle

X.Qiyas operates as a repeating cycle. Each stage produces the input for the next, and every stage is recorded - which is what makes readiness measurable rather than estimated.

01

Standards

Frameworks configured as structure.

02

Assignments

Every control given a named owner.

03

Execution

Work happens on schedule, not at submission.

04

Evidence

Attached to the control it satisfies.

05

Validation

Recorded by the reviewer, with an audit trail.

06

Readiness

Scored continuously across the organisation.

07

Improvement

Gap closure tracked as work.

Modules

Manage the entire compliance cycle

01

Standards & controls

Standards, domains, controls and criteria held as structured records with version history.

and 5 more below

X.Qiyas Illustrative
MODULE Standards & controls Active Structure 4 levels · 89 controls Standard QIYAS · Perspectives & axes 5 perspectives Domain Strategy & governance Control CTRL-04.2 · Ownership assigned and recorded Validated Control CTRL-04.3 · Access reviewed each quarter In review Version 3.2 · Published 12 Feb Versioned Structure illustrative

Workflow automation

Submission, review, rework and approval routed automatically with reminders and escalation.

Readiness & measurement

Scoring against the standard's own model, by control, domain, department and entity.

Dashboards

Readiness, progress, overdue items and risk concentration for operational and executive audiences.

Governance & risk

Non-compliance risk registered, rated, owned and tracked to mitigation.

Auditability

A complete record of who submitted what, when, who validated it and on what basis.

Digital government

Built with Saudi digital government requirements in mind

The platform reflects how digital government readiness is assessed in the Kingdom.

X-Shift’s compliance work is grounded in supporting organisations through Saudi digital government assessment. For this reason, X.Qiyas models standards, controls, evidence and measurement cycles in the way assessors expect them to be presented.

Roles

Built for the six roles that run it

A compliance platform is procured by one role and used by six. Each needs a different view of the same cycle, and none should be able to see everything.

01

Executive leadership

A readiness number, the trend behind it and the gaps that matter, at organisation level - enough to brief a minister within minutes, without convening three meetings to assemble it.

and 2 more below

X.Qiyas Illustrative
ROLE VIEW Executive leadership View READINESS 78% ▲ +6 from last cycle OPEN GAPS 14 ● 3 critical OVERDUE 6 across 4 departments ENTITIES 4 all reporting Trend · last 4 cycles Improving MATTERS TO DISCUSS Cybersecurity domain below threshold at 1 entity 6 controls overdue in Operations and HR Evidence coverage up to 91% this cycle View illustrative

Control owners

A clear list of controls they own, with a simple route to submit evidence.

Internal auditors

Validation, findings and a complete traceable history of every action.

Evidence

Evidence, from upload to audit

Most entities do hold the evidence. What they cannot do is locate it, prove that it was current at the time, or show who approved it, because it is spread across drives, inboxes and personal laptops. This lifecycle replaces that.

THE TRAIL IS THE PRODUCT

An assessor tests whether the evidence holds up, not whether it exists.

01

Collected in one repository

Policies, procedures, screenshots, certificates and reports held in one workspace against the control they evidence, rather than in the folder of whoever produced them.

OutputOne place an assessor can be pointed at
02

Versioned, not overwritten

Check-in and check-out with full version history and point-in-time restoration, so the version that was current during a cycle can still be produced afterwards.

OutputThe version that applied, still retrievable
03

Validated before it counts

Multi-stage review and approval with reviewer comments and rejection handling, so evidence is confirmed as adequate rather than merely uploaded.

OutputEvidence that has been accepted, not just filed
04

An audit trail that cannot be edited

Every change recorded with timestamp, user and description, held immutably so the history stands on its own when a reviewer tests it.

OutputA defensible record of who did what, when
05

Found in seconds

Retrieval by control, domain, owner, cycle or date, so responding to an evidence request is a search rather than a reconstruction.

OutputAn answer during the review, not after it

Deployment

Deployed where the data has to stay

For a government entity this is rarely a preference. The same platform, the same experience and the same controls run either way.

01

On-premises

Deployed inside your own network as an isolated environment - application, database and storage all within the perimeter you control, with your directory and mail services.

and 2 more below

X.Qiyas Illustrative
DEPLOYMENT On-premises What sits where Your perimeter Channels Voice, chat, email, portal Inside X.24 runtime Agents, tools, orchestration Inside Model runtime LLM inference Inside Knowledge and data Indexed content, records Inside Inside your perimeter · illustrative

Environment separation

Separate UAT and production environments, so configuration and framework changes are proven before they reach a live measurement cycle.

Continuity and recovery

Monitoring, backup and disaster recovery as part of the operating model rather than as an assumption about the hosting underneath it.

Inside X.Qiyas

Know your Qiyas score before the evaluator does, and close the gap in time

This is X.Qiyas from the inside: readiness and degree by perspective, every standard with its requirements and evidence, owners and approvals, and the reports the Qiyas team is asked for. Figures shown here are illustrative.

01 · EXECUTIVE READINESS

Your Qiyas readiness, in one number and the reasons behind it

The executive dashboard shows how ready the organisation is for the next Qiyas measurement: readiness, the degree achieved against the maximum, evidence coverage and overdue work. Filter by period, stage, unit or risk level and export it as a PDF.

  • Readiness and achieved degree for the current period
  • Evidence coverage, open gaps and overdue tasks
  • Filters by period, stage, unit and risk, with PDF export
Overall readiness
0
Achieved degree
0 / 89.1
Evidence coverage
0
Overdue tasks
0
Status breakdownQiyas 2027 · Stage 2
0standards
Complete55
In progress19
Incomplete8
Not started7
Commitment level
TotalPartialNoneNot applicable
02 · RISK HEATMAP

See where the risk sits before the evaluator does

Every standard carries a risk level. The heatmap crosses risk with progress, so a critical standard that has not started stands out at once, and one click filters the whole dashboard to that risk level.

  • Critical, high, medium and low risk against status
  • Average readiness for each risk level
  • One click to filter every view by risk
Risk heatmapClick a row to filter
CompleteIn progressIncompleteNot startedReadinessCritical0210
48%High3521
61%Medium14732
79%Low38524
91%
Needs attentionCritical & high
5.9.2 · Risk register approvedCritical · in progress · 48%
5.10.1 · Business continuity planHigh · evidence missing
03 · DEGREE OF COMPLIANCE

The degree you will be scored on, perspective by perspective

X.Qiyas tracks the achieved degree against the maximum for every perspective and pillar, using the same structure as the official measurement. Leaders see which perspectives carry the score and which are holding it back.

  • Achieved degree against maximum, per perspective
  • Drill down from perspective to pillar to standard
  • The organisation's Qiyas result recorded for each period
Degree of compliance69.8 / 89.1
5.1  التخطيط للتحول الرقمي91% · 9.2 / 10.1
5.2  حوكمة التحول الرقمي84% · 8.4 / 10
5.3  البنية المؤسسية76% · 9.1 / 12
5.4  الثقافة والبيئة الرقمية70% · 6.3 / 9
5.9  إدارة المخاطر55% · 6.6 / 12
Qiyas result · 2024
0
Target · 2027
0
04 · STANDARDS FRAMEWORK

Every perspective, pillar and standard, in the official structure

The full standards framework is loaded in Arabic, from perspectives to pillars to individual standards. Each standard has its degree, risk classification and owning unit, and earlier periods are kept in an archive.

  • Perspectives, pillars and standards in the official structure
  • Degree, classification and owner on every standard
  • Periods, stages and a standards archive
Perspectives
0
Pillars
0
Standards
0
المعاييرStage 2
5.1 التخطيط للتحول الرقمي
5.1.1 التخطيط الاستراتيجي للتحول الرقمي
5.1.2 التخطيط التنفيذي للتحول الرقمي
5.1.3 تأسيس وحدة لإدارة مشاريع التحول
05 · THE STANDARD WORKSPACE

Everything one standard needs, on one page

Each standard opens into a workspace with its requirements, indicators, tasks, questions sent to DGA and field visits. Owners record the commitment level, link evidence to each requirement and track progress against the target date.

  • Requirements linked to their evidence documents
  • Indicators for commitment, upload status and readiness, by stage
  • Tasks, DGA inquiries and field visits in the same place
5.1.1 · Strategic planning for digital transformationDegree 1.1
RequirementsIndicatorsTasksInquiries to DGAField visits
CodeRequirementEvidenceStatus
R1Approved DT strategy3 filesComplete
R2Strategy linked to Vision 20302 filesComplete
R3Annual review minutes1 filePartial
R4KPI baseline-Pending
Indicator 5.1.1.1Stage 2
Total commitmentUploadedTarget 30 Nov
Readiness92%
06 · EVIDENCE & LIBRARY

Evidence collected once, linked where it counts

Evidence documents are uploaded against requirements and kept in a library organised by perspective. Upload status and document availability are tracked, so the team knows what is ready, what needs updating and what is missing.

  • Evidence linked to each requirement
  • Availability: complete, needs update or missing
  • A library organised by perspective, with attachments
Evidence upload status89 standards
UploadedPartly uploadedNot uploaded
Library10 folders
Strategy
Governance
Architecture
Culture
Leadership
Capabilities
07 · TASKS & OWNERSHIP

Every requirement has an owner and a date

Work is broken into tasks with assignees and expected completion dates. Each person sees their own tasks and attachments, late work is flagged automatically, and every task keeps a timeline of what happened.

  • Tasks with assignees, due dates and a timeline
  • A personal task list for every user
  • Late work flagged before it affects the score
Open tasks
0
Overdue
0
Certified
0
My tasks15 assigned
StandardTaskDueStatus
5.2.2Approve governance charter12 NovLate
5.3.2Upload EA repository export18 NovIn progress
5.7.2Process KPI evidence02 NovCompleted
5.6.2Training plan sign-off28 OctCertified
08 · APPROVAL WORKFLOWS

Nothing counts until it is reviewed and approved

Tasks and evidence attachments move through approval workflows you design, with reviewers at each step. Workflows are versioned, so a change never disturbs work already in flight, and every reviewer has a queue of pending approvals.

  • Approval flows for tasks and attachments
  • Versioned workflow definitions, published when ready
  • A pending-approvals queue and notification templates
Task approvaltask-approval · v4
Submitted→Unit review→Qiyas team→Approved→Certified
My pending approvals6 waiting
Attachment · 5.3.2 EA repositorySubmitted by Enterprise Architecture
Task · 5.1.3 PMO charterSubmitted by Strategy PMO
09 · DGA INQUIRIES & FIELD VISITS

Questions to the regulator and visits, on the record

When a standard needs clarification, the question is sent to DGA from the standard itself and the answer stays with it. Field visits are scheduled against the standard, and DGA feedback is captured for the team to act on.

  • Inquiries to DGA, with answers kept on the standard
  • Field visits scheduled and tracked by status
  • DGA feedback captured after every visit
Inquiries sent to DGA5.9.2
Does a risk appetite statement approved by the board meet requirement R2?
DGA answer · Yes, if it is linked to the enterprise risk register.
Field visitsScheduled
Data office · evidence walkthrough24 Nov · confirmed
Infrastructure · DR siteFeedback received
10 · GAPS

Every gap logged, owned and closed

Gaps found in self-assessment or raised after a field visit go into one register with a severity, an owner and a target date. The gaps report shows what is still open across the organisation.

  • A single gap register for the organisation
  • Severity, owner and target date on every gap
  • A gaps report for leadership
Open gaps
0
Closed this quarter
0
Gap registerOpen
No approved DR test results5.10.2 · Infrastructure
Digital culture survey not repeated5.4.2 · HR
Procurement policy references outdated5.8.1 · Services Support
11 · UNITS & DEPARTMENTS

Each department sees its share of the score

Standards are assigned to organisational units, each with a manager and a team. Completion, overdue work, critical items and evidence coverage are shown for every unit, so the follow-up goes to the right desk.

  • Standards assigned to units and their users
  • Completion and evidence coverage by unit
  • Overdue and critical items by department
Departments15 units
Governance and Compliance14 standards · 92%
Enterprise Architecture11 standards · 84%
Data Office9 standards · 77%
Infrastructure8 standards · 66%
HR6 standards · 58%
12 · REPORTS

The reports the Qiyas team is asked for, ready

Eight reports cover degrees, uploads, notes, tasks, readiness, Qiyas results, units and gaps, each filtered by period, stage and organisation. The numbers come from the same records the teams work in.

  • Degrees and readiness by pillar and standard
  • Qiyas results across periods
  • Units, tasks, notes and gaps reports
Reports8 ready
Degrees
File-upload degrees
Notes
Tasks
Readiness
Qiyas results
Units standard
Gaps
Readiness by quarterQiyas 2027
52%Q1
63%Q2
71%Q3
78%Q4
95%Target
The official structurePerspectives, pillars and standards as they are measured.
Evidence that holds upLinked to requirements, reviewed and approved.
Owners, not spreadsheetsEvery task and gap has a name and a date.
Arabic-firstStandards and workflows in Arabic and English.

Use cases

Where continuous readiness matters

A compliance platform earns its place in organisations that are assessed against a published standard and cannot describe their position in the months between assessments.

01

Readiness between assessment cycles with X.Qiyas

Situation

A ministry knows its readiness position only when the assessment window opens, and the months in between pass without anyone able to state where it stands.

What happens
  1. Map the control
  2. Assign the owner
  3. Capture the evidence
  4. Validate and score
Outcome

Readiness is scored continuously in X.Qiyas against the standard's own model, by control, domain and department.

Commonly applied in Government and across other sectors

02

Controls owned across affiliated entities with X.Qiyas

Situation

A ministry is assessed as one organisation while the controls are met by affiliated entities that have their own systems, teams and reporting lines.

What happens
  1. Map the control
  2. Assign the owner
  3. Capture the evidence
  4. Validate and score
Outcome

Each control carries a named owner in a named entity, and the consolidated position is visible without collecting returns by email.

Commonly applied in Government and across other sectors

03

Evidence gathered before submission with X.Qiyas

Situation

Evidence for an assessment is collected by email in the weeks before the deadline, and much of what arrives has no date, author or link to a control.

What happens
  1. Map the control
  2. Assign the owner
  3. Capture the evidence
  4. Validate and score
Outcome

Evidence is attached to the control it satisfies as it is produced, with type, date, author and version held against it.

Commonly applied in Government and across other sectors

More ways to apply it

Chasing submissions by email with X.Qiyas

Submission, review and rework are routed automatically with reminders and escalation, so chasing is a platform task rather than a person's.

Government

One control, several regulators with X.Qiyas

Controls are held once as structured records and mapped to each obligation, so one piece of evidence serves every framework it satisfies.

Banking

Accreditation readiness across facilities with X.Qiyas

Progress and overdue items are visible per facility on the same dashboard, so attention goes where the gap actually is.

Healthcare

A national cycle across institutions with X.Qiyas

The cycle carries a defined scope, timeline and submission window, and every submission arrives against the same control structure.

Education

Findings that reappear each cycle with X.Qiyas

Gap closure is tracked as assigned work with an owner and a due date, and the audit trail records what was done.

Utilities

Proving what was approved, and when with X.Qiyas

Submission, validation and approval are recorded as they happen, so the question is answered from the audit trail.

Telecommunications
Explore by industry

Illustrative applications rather than named engagements; the frameworks in scope for any organisation should be confirmed during assessment.

Common questions

What buyers ask before an evaluation

Next

Where to go next

See the compliance cycle

A walkthrough of controls, assignment, evidence capture, validation and readiness scoring against a framework on which you report.

When the control model is settled and the problem is operating it.

Request a demonstration

Establish the position first

DGA Compliance Advisory assesses readiness, identifies gaps and designs the ownership model before any platform is introduced.

When you are not yet certain what your obligations are or who owns each one.

DGA Compliance Advisory

A platform makes a good control model operable. It does not make an absent one compliant.

Where this sits

Related

Deployed asDigital Compliance & MaturityContinuous readiness as a business capability.
Designed byDGA Compliance AdvisoryThe expertise that sets the platform up correctly.
Designed byDigital Maturity & Transformation StrategyFrom assessment to transformation roadmap.
Designed byDigital Governance & Operating ModelWho decides what, and how it is governed.

Also relevantGovernmentData Governance & Management

Industry applications

X.Qiyas across sectors

The platform is the same in each of these. What changes is what it is configured to do and which systems it connects to.

Government & Public Sector

Beneficiary channels, case handling and compliance evidence, built as one programme.

How the portfolio applies here Utilities

Billing, outage and connection demand handled across channels, field and back office.

How the portfolio applies here Education

Applicant and student service that holds up through admissions peaks and audit.

How the portfolio applies here Energy & Oil & Gas

Safety compliance, contractor governance and asset condition across distributed sites.

How the portfolio applies here

These are the sectors in which this platform is most often applied. It is not limited to them; the requirement, not the industry, determines applicability.

Built on this

Solutions that deploy X.Qiyas

A solution is built from this platform, scoped to your organisation and delivered through to go-live.

Digital Governance & Compliance

Digital Compliance & Maturity

Readiness you can see all year, not the week before assessment.

SERVICES THAT SUPPORT THE DECISION TO DEPLOY ITBeneficiary Experience & Government Standards AdvisoryDGA Compliance AdvisoryDigital Maturity & Transformation Strategy

See X.Qiyas against a scenario close to yours

We run demonstrations on a journey you actually handle rather than on a script written to show the product well.

Start a conversation

Get ahead of the next Qiyas cycle

Walk into the next Qiyas cycle already ready

Your standards in Arabic Evidence linked to requirements Gaps and approvals tracked
Book an X.Qiyas demo A 30-minute walkthrough on your own framework
See X.Qiyas on your own standards

Qiyas-ready, all year round.

Tell us your period and the standards you are measured on, and we will show X.Qiyas tracking your readiness, evidence and gaps in one place.

Book an X.Qiyas demo