Consulting · 01
Information security & compliance
Know where you stand, fix what matters, and prove it to your customers, auditors and regulators.
01The problem
Security questions are arriving faster than answers.
- 1.1
Customers want proof.
Larger customers send security questionnaires and ask for an ISO/IEC 27001 certificate or a SOC 2 report before they sign.
- 1.2
The law has caught up.
India’s DPDP Act, the GDPR and sector rules put duties on how you handle personal data, and those duties need owners, processes and records.
- 1.3
No one owns security.
It sits between IT, the founders and a vendor or two, so the basics slip and nobody can say what’s covered.
- 1.4
You can’t see the risk.
Without an inventory of your systems, data and suppliers, there’s no way to tell which gaps matter most.
02What we do
From first assessment to a clean audit.
Take one piece or the whole programme. Every piece stands on its own.
- Security assessment and gap analysis
- A clear picture of where you stand against a framework, with every gap ranked by risk.
- ISO/IEC 27001 readiness
- Scope, risk assessment, Statement of Applicability, controls and internal audit, ready for certification.
- SOC 2 readiness
- Controls mapped to the Trust Services Criteria, evidence collected, and a readiness review before your auditor arrives.
- DPDP Act and GDPR compliance
- Data maps, notices, consent, rights requests and breach response that meet India’s and Europe’s rules.
- Policies, risk and controls
- A policy set people can follow, a risk register that stays current, and controls that fit how you work.
- Vendor risk and awareness
- Due diligence on your suppliers, and security-awareness training for every team.
03How it runs
A typical readiness programme.
Twelve weeks from first meeting to audit-ready, for a company of around 50–200 people.
- 01Week 1
Scope
Agree the framework, the systems and the teams in scope.
- 02Weeks 1–3
Assess
Interviews, document reviews and technical checks against the framework.
- 03Week 4
Plan
A remediation roadmap ranked by risk and effort, with an owner for every item.
- 04Weeks 5–12
Implement
We help your team close the gaps: policies, controls and evidence.
- 05Ongoing
Prove
Internal audit, liaison with your auditor, and support through certification.
04What you get
Documents you keep, not slides you forget.
Everything is written down, in plain language, and yours to keep.
- SEC-01
Gap assessment report
Where you stand, control by control.
- SEC-02
Risk register
Every risk, its owner and its treatment.
- SEC-03
Statement of Applicability
The ISO/IEC 27001 controls you apply, and why.
- SEC-04
Policy set
Short, plain policies your people will read.
- SEC-05
Remediation roadmap
What to fix, in what order, by when.
- SEC-06
Board summary
Two pages for leadership and investors.
05Questions
What people ask us.
Do you certify us?
No. Accredited certification bodies issue ISO/IEC 27001 certificates, and licensed CPA firms issue SOC 2 reports. We get you ready and stay with you through the audit.
How long does ISO/IEC 27001 take?
For a small or mid-sized company, getting ready usually takes three to six months. It depends on your scope and on how much is already in place, which the assessment tells you.
Does India’s DPDP Act apply to us?
If you process digital personal data in India, or offer goods or services to people in India from abroad, it very likely does. We’ll confirm what applies to you and what to do first.
Can you work with our IT provider?
Yes. We define what’s needed and work alongside your in-house team or your managed service provider to deliver it.
Find out where you stand.
A short conversation tells us which framework fits and what an assessment would cover.