Services
What we do
Three kinds of engagement, and the difference between them is who signs at the end. Most clients arrive needing one and find the evidence it produces carries straight into the next.
An independent body signs
Certification & Attestation
Management systems and attestation reports that an independent body examines and issues. We build what they examine.
Management system
ISO/IEC 27001 — Information Security Management
Build an information security management system that survives Stage 2 — and the three years of surveillance that follow.
Attestation
SOC 2 Type 1 Readiness
Prove your controls are designed and in place on a given date — the fastest honest way to unblock a contract.
Attestation
SOC 2 Type 2 Readiness
Evidence that your controls ran for months, not that they existed on a date — the report enterprise procurement usually means.
Management system
ISO 22301 — Business Continuity Management
Know which activities cannot stop, how long they can be down, and what you will actually do — tested before you need it.
Management system
ISO/IEC 27701 — Privacy Information Management
Turn privacy from a policy document into a management system, with the records a regulator or an enterprise buyer will ask to see.
Management system
ISO/IEC 42001 — Artificial Intelligence Management
Put governance around the AI you build or buy, in a form an enterprise customer will accept as evidence.
Management system
ISO 14001 — Environmental Management
Build an environmental management system to the current edition — or move a 2015 certificate onto it before the transition closes.
We prepare and we advise. Assessment is performed by an independent accredited certification body or a licensed CPA firm, and we are neither.
A regulator sets the bar
Regulatory Compliance
Obligations set by a statute, a regulator or the card schemes — met, evidenced and kept current, rather than certified once.
Data protection law
DPDP Act Compliance for Indian Companies
Be ready for the duties the Digital Personal Data Protection Act places on you from 13 May 2027 — starting with knowing where personal data actually lives.
Regulation · EU
GDPR Compliance
Work out whether the GDPR reaches you directly or by contract, then build the records, processes and transfer answers either route demands.
Payment security
PCI DSS Compliance
Get your cardholder data environment scoped, remediated and evidenced for PCI DSS v4.0.1 — before a QSA or your acquirer asks to see it.
Insurance regulation
IRDAI Cybersecurity Compliance: Insurance Companies, ISNP Audit & Broker/TPA Assessments
Prepare for the annual IRDAI cyber security assurance audit and the half-yearly testing the 2026 guidelines require — and close what they find inside IRDAI’s clocks.
Payments regulation
System Audit Report (SAR) for Data Localisation and Payment Compliance
Show that your payment data is stored only in India — across your systems and your vendors’ — before a CERT-In empanelled auditor tests it and signs the System Audit Report.
We prepare and we advise. Where a regulator or a card scheme requires an audit, an auditor who meets its criteria — a CERT-In empanelled auditor, an eligible audit firm, an independent data auditor or a PCI Qualified Security Assessor — conducts and signs it, and we are none of these.
We are the assessor
Security Testing
Technical testing of networks, applications, APIs, mobile apps, cloud configuration and code, to published methodology.
Technical testing
Vulnerability Assessment and Penetration Testing (VAPT)
Find what an attacker would find, ranked by what it would actually cost you — and get a report your auditor and your engineers can both use.
Technical testing
Network Penetration Testing
Test your network the way an outsider would, then the way someone already inside would — and prove that the boundaries you rely on to keep systems apart actually hold.
Technical testing
API Security Testing
Find the request that returns somebody else’s data — the flaw that leads the OWASP API Security Top 10 and the one an automated scanner cannot recognise.
Technical testing
Mobile Application Security Testing
Your app tested on a device an attacker controls, against the OWASP mobile standard — and the API behind it tested as well, because that is where the data is.
Technical testing
Cloud Security Assessment
Review the part of the cloud that is yours to secure — identities, network exposure, storage, logging and keys — against a published baseline and against how an attacker would actually move through it.
Technical testing
Secure Code Review
A reviewer reading your code for the flaws a scanner cannot see — with the scanner’s output triaged rather than forwarded.
Here we are the assessor. We test, report and retest ourselves, and we will not test a control we designed and present it as independent assurance.
Latest insights
Regulation
The CERT-In directions: a six-hour clock, and two duties that bind you before anything happens
What the 2022 directions actually say, which obligations apply on an ordinary day, and where the six-hour clock starts.
Choosing
ISO/IEC 42001: do you need an AI management system yet?
What the standard covers, who is actually in scope, and an honest account of when certifying is premature.
Choosing
A third-party risk programme that is not just a questionnaire you send
How to tier a supplier estate, decide what to ask whom, and keep the answers current once the onboarding is over.
