GRC software requirements checklist & RFP builder

• Cloud (SaaS) deployment option Must have Should have Nice to have
• On-premise deployment option Must have Should have Nice to have
• Data residency in Qatar / KSA / UAE Must have Should have Nice to have
• Arabic and English bilingual interface Must have Should have Nice to have
• Arabic report and dashboard output Must have Should have Nice to have
• Single sign-on (SAML / Azure AD) Must have Should have Nice to have
• Role-based access control with segregation of duties Must have Should have Nice to have
• Full audit trail of user activity Must have Should have Nice to have
• Configurable workflow engine (approvals, escalations) Must have Should have Nice to have
• REST API for integrations Must have Should have Nice to have
• Configurable dashboards and scheduled reports Must have Should have Nice to have
• Full data export on exit (database-level, not PDF) Must have Should have Nice to have

• Risk register with configurable taxonomy Must have Should have Nice to have
• Configurable scoring matrices (e.g. 5x5) and risk appetite Must have Should have Nice to have
• Inherent and residual risk assessment workflow Must have Should have Nice to have
• Key risk indicators with thresholds and alerts Must have Should have Nice to have
• Risk treatment / action plans with owners and due dates Must have Should have Nice to have
• Incident and loss-event capture linked to risks Must have Should have Nice to have
• Heat maps and board-level risk reporting Must have Should have Nice to have

• Pre-loaded framework libraries (NCA ECC, SAMA CSF, QCB, PDPPL, ISO 27001) Must have Should have Nice to have
• Cross-framework control mapping (one control, many frameworks) Must have Should have Nice to have
• Control assessment and testing schedules Must have Should have Nice to have
• Evidence collection tasks with reminders Must have Should have Nice to have
• Policy management with attestation campaigns Must have Should have Nice to have
• Regulatory change tracking Must have Should have Nice to have
• Read-only auditor / regulator access Must have Should have Nice to have

• Risk-based audit universe and annual planning Must have Should have Nice to have
• Engagement scheduling and resource allocation Must have Should have Nice to have
• Electronic workpapers with review notes Must have Should have Nice to have
• Findings and recommendations tracking Must have Should have Nice to have
• Automated follow-up of management actions Must have Should have Nice to have
• Audit report generation (Arabic and English) Must have Should have Nice to have
• Time tracking per engagement Must have Should have Nice to have

• Business impact analysis (BIA) workflow Must have Should have Nice to have
• Continuity and recovery plan authoring Must have Should have Nice to have
• Dependency mapping (processes, systems, sites, vendors) Must have Should have Nice to have
• Exercise and test management with findings Must have Should have Nice to have
• Crisis notification / activation Must have Should have Nice to have
• ISO 22301 / NCEMA 7000 alignment Must have Should have Nice to have

• Support coverage during GCC working days (Sun–Thu) and hours Must have Should have Nice to have
• Implementation delivered by vendor or regional partner Must have Should have Nice to have
• Reference customers in the GCC Must have Should have Nice to have
• Transparent pricing model (users, modules, tiers) Must have Should have Nice to have
• Training and onboarding included Must have Should have Nice to have
• Product roadmap and release cadence shared Must have Should have Nice to have

Custom requirements