Certifications and audits
We prepare you for the audit or assessment a customer or regulator asks for. An accredited firm then issues the certificate or report.
GRC and compliance services
Get audit-ready and stay ready — with proof an auditor can check.
We run compliance programs for ISO 27001, SOC 2, GDPR, HIPAA, PCI DSS, India's DPDP Act and more, from gap assessment to audit. We help your team build the dated record an auditor checks, and tell you early whether your target date holds.
- An honest target date, early
- Policies built around how you work
- We reply within one working day.
- ISO 27001
- SOC 2
- GDPR
- HIPAA
- PCI DSS
- DPDP Act
In brief
- What it is
- GRC means governance, risk and compliance. We help you meet a standard or law, such as ISO 27001, SOC 2 or GDPR, and keep meeting it.
- Why it matters
- Large buyers often ask for a certificate or report before they sign. A program also makes you find and treat risks before they end in a breach or a fine.
- What you get
- Evidence that customers, partners and regulators can verify, built by your team with our help, and an honest date for your audit.
What we cover
Certifications, laws and the work between audits.
Pick a framework to see how we scope it. Not sure which applies? The guide below starts from the request you received.
Laws and frameworks
We work out what a law or framework asks of you, then build only what your situation needs.
Ongoing programs and risk
We keep evidence current between audits, lead security with you part-time, and turn risk into decisions your board can follow.
Governing AI as well? AI governance starts with an inventory of every AI system you run.
What certification and audit work includes
- ISO 27001. The international standard for an information security management system (ISMS). We take you from gap analysis to the certification audit, then help you keep the ISMS running.
- SOC 2. Readiness, control design, evidence and auditor liaison for Type 1 and Type 2. Security is always in scope; you choose which of the other four categories to add.
- PCI DSS. Scoping the cardholder data environment, a gap assessment and a remediation roadmap, then preparation for your SAQ or QSA assessment.
- ePHI controls engineering. We implement and document the security controls for electronic health data that a HITRUST-licensed assessor tests.
What law and framework work includes
- GDPR. Data mapping, lawful basis review, privacy notice reviews, data protection impact assessments, breach readiness and DPO advice under the EU and UK GDPR.
- India DPDP Act. Fiduciary or processor classification, consent and notice design, security safeguards, breach reporting and retention. The duties commence in three tranches, which decides what you build first.
- HIPAA / HITECH. Security risk analyses, administrative safeguard reviews, Business Associate Agreement checks and compliance programs for US healthcare organizations and their vendors.
- NIS2. Whether NIS2 reaches your company, what its risk-management and incident-reporting duties require, and where DORA applies instead. We advise UK and EU clients remotely from India.
- NIST CSF. A maturity assessment, profiles and a roadmap aligned to the NIST CSF, so you know which improvements come first.
The evidence trail
An auditor checks the record, not the policy.
An auditor wants dated proof that you followed your own policies.
A policy pack gives you documents. It can't give you the trail behind them: approvals, review dates, exceptions raised and closed, and a named person accountable for each.
So your timeline depends more on your team than on your consultant. If someone inside the business owns access reviews and runs them every quarter, about eight months is realistic. If nobody owns them, more documents won't fix it, and we'll tell you so in the gap assessment. Our ISO 27001 case study shows it: certification in eight months, because the client owned the work.
We keep the control set in proportion, too. A twenty-person SaaS company doesn't need a bank's control environment, and an auditor won't thank you for building one.
Want help running a control, not only documenting it? Monthly vulnerability scanning is a common one: see vulnerability management.
Find the right framework
Start with what you've been asked for.
Compliance work usually starts with a customer request, a tender clause or a new law. Find yours below.
- A US customer asked for a SOC 2 report.SOC 2 readiness
- A European or Asian tender names ISO 27001.ISO 27001
- We handle personal data of people in India.DPDP Act readiness
- We hold personal data of customers in the EU.GDPR compliance
- Card payments pass through our systems.PCI DSS
- A US healthcare client sent us a Business Associate Agreement.HIPAA compliance
- We serve the EU and aren't sure if NIS2 or DORA applies.NIS2 advice
- Our board wants to know where security stands, no certificate needed.NIST CSF 2.0
- We want a certificate that covers how we manage AI.ISO/IEC 42001
- We passed the audit, and the evidence is going stale.Compliance as a Service
- We need a senior security lead, but not full-time.vCISO
- Our vendors hold accounts and API keys nobody has reviewed.Third-party risk
How a compliance program runs
Five stages, and one of them can't be rushed.
The gap assessment decides most of what follows: which controls you're missing, who owns each one, and how long the operating period takes.
Gap assessment
Weeks one to six. We compare how you work today with what the framework asks for, rank every gap, and agree the scope and an owner for each control.
Policies and controls
Months one to three. We write policies, procedures and technical controls around how your business runs, and help set up the tooling.
Rollout and the operating period
We help your team put controls in place, run short awareness sessions and start collecting evidence. Controls then run for three months or more, building the dated record the auditor tests: owners, tickets, logs and reviews. Extra effort can't shorten this.
External audit
Stage 1 and Stage 2 for ISO 27001, or fieldwork for SOC 2. We prepare your team for auditor interviews and join the walkthroughs.
Certificate or report, then upkeep
The ISO certificate or SOC 2 report usually follows four to eight weeks after the audit. We help you close any findings and keep it current.
Deliverables
What you end up with.
A gap register in priority order
Each gap is mapped to a control and sorted into audit blockers and good practice, so page one tells you what to do on Monday.
Policies people can follow
Written around how your business runs. A policy nobody follows hands the auditor evidence of a control failure.
An evidence plan
Which records to collect, who collects them and how often. This plan decides whether your audit goes smoothly.
A named owner for every control
Agreed with you, one person per control. A control without an owner fails at the first review.
Support through the audit
We sit in on the audit, answer the technical questions and help you close findings, so you aren't left explaining a control we designed.
A maintenance calendar
ISO 27001 has surveillance audits at about 12 and 24 months, and a SOC 2 report goes stale after about a year. You leave knowing what recurs and when.
What this work does not include. We aren't a certification body, a CPA firm or a PCI QSA Company, so we don't issue ISO certificates, SOC 2 reports or PCI DSS Reports on Compliance. We prepare you for the firm that does. We also hold no HITRUST license and don't run HITRUST readiness assessments.
FAQ
Questions about GRC and compliance.
Timelines, policies and which framework comes first. For anything else, ask us directly.
Usually eight to twelve months from kickoff to the Stage 2 audit, then four to eight weeks to close any nonconformities and receive the certificate. The biggest variable is ownership: whether someone inside the business owns each control and runs it on schedule. Where that's clear from the start, eight months is realistic. Where it isn't, more documentation won't shorten the timeline.
It depends on who is asking. North American enterprise buyers usually ask for a SOC 2 report. ISO 27001 travels better internationally and is more often named in European and Asian procurement. If a deal is stalling on this, tell us which framework the customer named, and we'll scope the work to that one.
Sometimes, and we'll tell you early whether it's realistic. If your controls have been running and the gap is evidence and documentation, eight weeks is often workable. If the controls don't exist yet, the auditor needs to see them operate for a period first, and nobody can shorten that.
We draft them; you review and own them. Policies written entirely by an outside firm tend to describe a company that doesn't exist, and they fail at the first control test. We start from how your business works and write that down.
GDPR applies if you handle data belonging to people in the EU, wherever you're based. India's DPDP Act covers processing in India, and processing outside India when you offer goods or services to people in India. Both need the same groundwork: what data you hold, why, where it goes, how long you keep it, and how you answer subject requests in time. Most of the effort is the data map, which most companies have never built.
Not yet. We follow the same practices internally where they apply to a company our size, and our terms of service include a responsible disclosure policy for our own site. If we certify, we'll publish the certificate number so you can check it.
Sources
- ISO/IEC 27001:2022, including Annex A control 8.8, management of technical vulnerabilities.
- AICPA Trust Services Criteria (TSP section 100), the basis of a SOC 2 examination. Security is required; Availability, Processing Integrity, Confidentiality and Privacy are optional.
- Digital Personal Data Protection Act, 2023, and the DPDP Rules, 2025, including Rule 6 on security safeguards.
- Directive (EU) 2022/2555 (NIS2): Article 21 on cybersecurity risk-management measures and Article 23 on reporting. Regulation (EU) 2022/2554 (DORA) for financial entities.
Let's talk
Find out where you stand.
Start with a gap assessment. We'll show you what's missing, who should own each fix and which date you can plan around. We reply within one working day.