Information security · compliance · assurance
Certification is a deadline. We make it a controlled one.
Your customer wants an ISO 27001 certificate or a SOC 2 report, and wants it this quarter. We build the management system that earns it, put the evidence behind every control, and stay in the room through the audit — so the certificate arrives on a date you chose.
Control set — ISO/IEC 27001:2022 + SOC 2
- A.5.15Access controlPassing
- A.8.12Data leakage preventionPassing
- A.8.24Use of cryptographyPassing
- CC6.1Logical access controlsPassing
Evidence verified sha256:9f2b…c41e
- ISO/IEC 27001:2022 certifiedWe run the system we implement.
- Audit-ready evidenceEvery control mapped to proof.
- India-based, on your timezoneOn site when it matters.
Services
Where we are usually brought in.
Most engagements start with one of these and grow into the next. The evidence one produces is most of what the next one asks for, so running two together costs far less than running them apart.
An independent body signs
Certification & Attestation
Management systems and attestation reports that an independent body examines and issues. We build what they examine.
A regulator sets the bar
Regulatory Compliance
Obligations set by a statute, a regulator or the card schemes — met, evidenced and kept current, rather than certified once.
We are the assessor
Security Testing
Technical testing of networks, applications, APIs, mobile apps, cloud configuration and code, to published methodology.
Where we sit
We prepare you for the audit. We do not sell the certificate.
An accredited certification body issues your ISO certificate; a licensed CPA firm signs your SOC 2 report. Neither may also build the management system it assesses — ISO/IEC 17021-1 forbids it, and it is what makes the certificate mean something. Our work is everything up to that line: the system, the controls, the evidence, the rehearsal, and the answers on audit day.
What we do
- Design and implement the management system
- Run gap assessments and internal audits
- Collect, structure and defend the evidence
- Test your controls the way an attacker would
- Brief and support you through Stage 1, Stage 2 and surveillance
What we never do
- Issue a certificate or sign an attestation
- Act as your certification body or your auditor
- Promise a pass — no consultancy honestly can
- Mark our own homework on an audit we prepared
At a glance
What an engagement actually looks like.
Durations assume an organisation under 200 people with a contained scope. We give you real figures once we have seen the estate — these are the shape, not a quote.
| Engagement | Standard | Typical duration | What you end with |
|---|---|---|---|
| ISMS implementation | ISO/IEC 27001:2022 | 6–9 months | Stage 2 audit, certificate issued by an accredited body |
| SOC 2 Type 1 | AICPA Trust Services Criteria | 6–12 weeks | A point-in-time report from a licensed CPA firm |
| SOC 2 Type 2 | AICPA Trust Services Criteria | 3–6 months + observation | A signed report covering the whole observation window |
| Penetration testing | OWASP · NIST SP 800-115 | 2–4 weeks | Severity-rated findings, remediation support, retest letter |
| Business continuity | ISO 22301:2019 | 4–8 months | A BCMS with exercised, evidenced plans |
| Privacy management | ISO/IEC 27701:2025 | 4–8 months | A PIMS mapped to your DPDP and GDPR obligations |
We prepare and we advise. The audit itself is performed by an independent accredited certification body or a licensed CPA firm, and we are neither.
How we work
A fixed scope, a named date, and no surprises in month three.
We scope from evidence, not from a questionnaire. You get a written statement of what is in scope, what it costs, who does what, and the date the certification body can be booked for — before the first invoice.
Who we work with
Organisations whose customers ask hard questions.
The trigger is almost always external: a regulator, an insurer or a bank doing due diligence, an enterprise procurement review, or a customer contract with a security schedule attached.
Insurance and claims services
IRDAI’s cyber security guidelines reach corporate surveyors and other intermediaries, not only insurers. The annual audit report goes to every insurer you work with, and each one decides on that evidence whether to keep working with you.
Banking and payments technology
Banks put technology vendors through due diligence before any transaction data flows, and where payment data is involved the RBI’s India-only storage rule reaches your architecture. Penetration testing on a defined cycle arrives as a contract term.
Cloud and hosting providers
Your customers’ compliance runs on your infrastructure. A SOC 2 report or an ISO 27001 certificate answers their auditors once, instead of one questionnaire per customer — and cloud configuration is where those auditors look first.
Enterprise software for regulated data
Buyers in legal, medical and media settings ask how their data is protected inside your product. When those buyers are in the UK or the EU, the GDPR arrives through the contract rather than through a regulator.
Education and employability platforms
Personal data of students and job-seekers, shared between institutions and employers. Under the DPDP Act, notice, consent and rights handling are product features, and the platform is the one that has to build them.
Environmental and ESG advisory
You hold clients’ confidential operational data and advise on management systems yourself. ISO 14001 and ISO 27001 share a clause structure, so one integrated system can answer both your clients’ questions.
Trusted by
Teams that answer to regulators, auditors and enterprise buyers.
Different sectors, different sets of obligations. The pattern is the same each time: someone external asked a question the organisation could not yet answer with evidence.
Proclaim Insurance Surveyors and Loss Assessors
Insurance loss adjusting and claims management
Operating in — India
Disk Archive Corporation
Enterprise archive systems for media, legal, medical and forensic data
Operating in — United Kingdom · India
Nirantara Solutions
Environmental consulting, ESG and sustainability advisory
Operating in — UAE · India
Goals101
Transaction behavioural intelligence for banks
Operating in — India · Malaysia · Sri Lanka · UAE
Singularis Ventures
Career and employability networks for higher education and employers
Operating in — India · UAE
Real Time Data Services (RTDS)
Cloud hosting and cloud telephony for accounting and business applications
Operating in — India · United States
Insights
The standards behind the work.
Explainers on what each standard actually requires, what it does not, and the dates that matter. Written for the person who has to act on them.
Regulation
The CERT-In directions: a six-hour clock, and two duties that bind you before anything happens
What the 2022 directions actually say, which obligations apply on an ordinary day, and where the six-hour clock starts.
Choosing
ISO/IEC 42001: do you need an AI management system yet?
What the standard covers, who is actually in scope, and an honest account of when certifying is premature.
Choosing
A third-party risk programme that is not just a questionnaire you send
How to tier a supplier estate, decide what to ask whom, and keep the answers current once the onboarding is over.
Next step
Tell us the deadline you are working to.
Send the date, the standard, and roughly how large the organisation is. You will get a reply from a practitioner — not a sales sequence — with an honest read on whether the date is reachable.