Switch From CyberArrow to Sahl: Migration Guide (2026)

Should You Switch From CyberArrow to Sahl?

Switching GRC platforms should start with a clear business reason. Your organization might be looking for AI-assisted PDPL workflows, built-in application security testing, cross-framework evidence mapping, or a different approach to implementation and pricing.

However, migrating during an active audit or assessment can introduce unnecessary complexity. Before changing platforms, evaluate whether your current setup meets your compliance requirements and whether a migration would deliver measurable operational value.

Sahl is an AI-powered GRC platform built for the MENA regulatory environment. Its stated capabilities include support for NCA ECC, SAMA CSF, and PDPL, cross-framework evidence mapping, an AI DPO assistant, and a built-in dynamic application security testing (DAST) scanner.

If these capabilities align with your organization’s needs, a structured migration plan can help you move toward Sahl while maintaining appropriate records of your existing compliance activities.

This guide explains the key steps involved in planning a migration. The exact process will depend on your CyberArrow configuration, available export options, data volume, and Sahl’s current import and implementation capabilities.

Step 1: Choose the Right Time to Migrate

Timing matters when moving compliance data between platforms.

Where possible, plan the migration after a major audit or assessment has been completed. If another assessment is approaching, allow sufficient time to validate the migrated data and resolve discrepancies before relying on the new platform.

As a planning guideline, consider starting at least eight weeks before your next major assessment. The appropriate lead time will vary depending on the size and complexity of your compliance program.

Before setting a migration date:

• Review upcoming audits and regulatory deadlines.
• Identify reporting periods that must remain accessible.
• Check contractual notice periods and renewal dates.
• Agree on responsibilities between compliance, IT, security, and vendor teams.
• Establish a rollback or contingency plan.

Practical tip: Do not retire your existing platform until the required data has been exported, reviewed, and securely archived.

Step 2: Export Your Existing Compliance Data

Before importing anything into Sahl, establish a complete record of the data you need to retain.

Check CyberArrow’s current export functionality and your contractual rights to access and export your organization’s data.

Depending on your configuration, the migration inventory may include:

• Control records: Control identifiers, descriptions, owners, statuses, and due dates.
• Evidence files: Supporting documents, collection dates, review dates, and associated controls.
• Policies and procedures: Current documents, version history, and approval records where available.
• Risk registers: Risk descriptions, assessments, treatment plans, and ownership information.
• Audit records: Reports, findings, remediation actions, and relevant historical records.
• Compliance mappings: Existing relationships between controls and regulatory frameworks.
• User and ownership information: Relevant assignments, responsibilities, and review workflows.

Keep the original export unchanged as a reference archive. Store it securely, restrict access appropriately, and verify that the files can be opened and read.

Where possible, retain metadata and timestamps alongside the original documents. These details can help reviewers understand the history of an evidence item.

Step 3: Map Your Existing Controls to Sahl

Exporting files is only one part of a GRC migration. Your team also needs to understand how existing control records relate to the requirements in the destination platform.

Start by listing every framework currently in scope, such as:

• NCA Essential Cybersecurity Controls (NCA ECC).
• SAMA Cybersecurity Framework (SAMA CSF).
• Saudi Personal Data Protection Law (PDPL).
• ISO 27001.
• SOC 2.

Next, document the controls, evidence, owners, and open remediation activities associated with each framework.

Sahl states that it provides pre-mapped coverage for supported Saudi frameworks and cross-framework mapping capabilities. During implementation, confirm the applicable framework versions and map your existing records to the corresponding controls.

Pay particular attention to controls that have different identifiers, wording, or evidence requirements across platforms.

Do not assume that two similarly named controls are equivalent. Have the relevant compliance owner review the mapping before approving it.

Step 4: Import Data and Reconcile Evidence

Once your data inventory and control mapping are ready, coordinate with Sahl to determine the supported migration and import process.

Depending on the available functionality, this may involve importing structured records, uploading documents, configuring integrations, or manually validating selected items.

After import, reconcile the destination platform against your original archive.

Check that:

• Required evidence files are present and accessible.
• Control owners and statuses are correctly assigned.
• Relevant dates and metadata have been preserved.
• Open findings and remediation activities remain visible.
• Evidence is linked to the appropriate framework controls.
• Duplicate, outdated, or incomplete records are identified.
• Access permissions reflect your organization’s requirements.

For organizations managing multiple frameworks, cross-framework mapping can help identify evidence that supports more than one applicable requirement. Each relationship should still be reviewed to ensure that the evidence satisfies the specific control.

Document discrepancies and obtain sign-off from the responsible control owners before treating the migration as complete.

Step 5: Run Both Platforms in Parallel

Where contract terms and implementation arrangements permit, run CyberArrow and Sahl in parallel during a defined validation period.

The objective is to confirm that the new environment reflects the compliance records your organization needs, rather than simply verifying that documents have been uploaded.

During this period:

1. Compare control statuses across both platforms.
2. Review evidence coverage for each in-scope framework.
3. Check open findings, remediation deadlines, and ownership.
4. Validate reports against the original records.
5. Resolve mapping differences and missing information.
6. Obtain approval from compliance and security stakeholders.

Set clear acceptance criteria before beginning the parallel run. For example, all critical controls and open findings must be accounted for, required evidence must be accessible, and material discrepancies must be resolved or formally documented.

This validation period helps reduce the risk of relying on incomplete or incorrectly mapped compliance records.

Step 6: Configure Monitoring and Security Workflows

After the core data has been reconciled, configure the workflows needed to maintain your compliance program going forward.

Depending on your requirements and the capabilities available in your Sahl subscription, this may include:

• Connecting supported systems and configuring evidence collection.
• Assigning control owners and review schedules.
• Establishing reminders and remediation workflows.
• Configuring AI-assisted PDPL activities through the AI DPO assistant.
• Evaluating the built-in DAST scanner for application security testing.
• Setting up dashboards and reporting for relevant stakeholders.

Confirm which integrations, scanning capabilities, and AI features are available for your deployment before planning the rollout.

Also define how your team will review automated findings, validate AI-generated recommendations, and escalate issues that require human judgment.

Migration should not end with transferring historical records. The new environment must support your ongoing compliance responsibilities.

Step 7: Train Your Team and Complete the Cutover

A successful migration requires more than technical validation. The people responsible for compliance need to understand the new workflows.

Before cutover:

• Assign owners to the relevant controls and frameworks.
• Train reviewers on evidence submission and approval workflows.
• Explain how findings and remediation activities will be tracked.
• Confirm reporting requirements with compliance stakeholders.
• Establish the process for handling access requests and support issues.
• Document the final cutover date and responsibilities.

Once the agreed acceptance criteria are met, move operational compliance activities to Sahl according to the approved plan.

Retain your original archive and any records required for audits, legal obligations, contractual requirements, or internal policies. Confirm the appropriate retention period with your organization’s compliance and legal teams.

Do not assume that importing evidence automatically transfers every historical audit trail or approval record. Validate those records separately where they are required.

Common Challenges When Migrating GRC Platforms

A structured migration can reduce disruption, but several issues deserve attention.

Missing Evidence or Metadata

Files may be available without their original timestamps, owners, or control associations. Compare imported records against the source archive and document any missing information.

Differences in Control Mapping

Framework versions and control structures may differ between platforms. Review the mappings carefully rather than treating similar labels as proof of equivalence.

Incomplete Audit History

Historical approvals, reviewer comments, and remediation events may not transfer in the same format. Determine which records must be retained and how they will remain accessible after cutover.

Unexpected Implementation Requirements

Data volume, integrations, custom fields, and existing workflows can affect the migration effort. Confirm the technical scope and implementation responsibilities with Sahl before finalizing the timeline.

Disruption to Ongoing Compliance Work

Teams may continue updating records in the old platform while the new environment is being prepared. Define a clear process for reconciling changes made during the migration period.

Frequently Asked Questions

Plan Your Migration to Sahl

Moving GRC platforms is an opportunity to review how your organization manages compliance evidence, control ownership, risk remediation, and ongoing monitoring.

A clear migration plan can help you preserve important records, identify mapping gaps, and establish reliable workflows in your new environment.

If your organization is considering a CyberArrow alternative for Saudi Arabia or the wider GCC, discuss your requirements with Sahl before setting a migration date.

Book a demo with Sahl to discuss your compliance requirements, migration scope, and implementation options.