Select requirements across risk, compliance, audit, BCM and GCC-specific criteria, and set a priority for each.
- Best for
- Teams about to issue an RFP or run vendor demos
- What you get
- A prioritised requirements list — download as CSV, copy, or print
Free GRC tools, templates and compliance assessments
Working tools, not gated PDFs. Use them to structure GRC work before you select software or start a formal assessment: build an RFP requirements list, set up a risk register, or check your readiness for NCA ECC, SAMA CSF or Qatar's PDPPL.
Everything here runs in your browser and needs no account. Nothing you enter is sent anywhere; progress is saved only in your own browser, and every tool exports to CSV.
Add risks, score likelihood and impact on a 3×3, 4×4 or 5×5 matrix, and see them plotted on a live heat map.
- Best for
- Starting or cleaning up a risk register
- What you get
- A scored risk register — download as CSV for Excel
NCA ECC self-assessment (ECC-2:2024)
Saudi ArabiaRate your implementation across all 28 subdomains of Saudi Arabia's Essential Cybersecurity Controls.
- Best for
- A first gap view before a formal NCA assessment
- What you get
- A subdomain-level gap list — download as CSV
SAMA CSF maturity self-assessment
Saudi ArabiaRate all 32 subdomains of the SAMA Cyber Security Framework against SAMA's six-level maturity model.
- Best for
- SAMA-regulated entities checking the gap to level 3
- What you get
- Your maturity gap to the required level 3 — download as CSV
Work through controller obligations under Law No. 13 of 2016 — lawful basis, notices, consent, rights, processors, security and 72-hour breach notification.
- Best for
- Controllers starting a Qatar data protection programme
- What you get
- A gap list of open obligations — download as CSV
Using these tools responsibly
The outputs are working aids. A self-assessment is not an audit, a checklist is not legal advice, and neither is proof of compliance. The regulators issue their own authoritative instruments — the NCA, for example, publishes its own ECC-2:2024 assessment and compliance tool. Check each tool's stated scope before using its results in formal reporting.