Asia-Pacific
Security Testing and Compliance Readiness Across Asia-Pacific
SecureRoot tests web applications, APIs, mobile apps and cloud accounts, reviews code, and prepares organisations for SOC 2 and ISO 27001, for clients across Asia-Pacific. We work from India and deliver internet-facing testing remotely; the coverage directory sets out, market by market, the rules we have verified and the questions to settle first.
How we work across the region
SecureRoot works from India and delivers testing of internet-facing applications, APIs and cloud accounts remotely, the way an attacker would reach them. Remote delivery does not cover work that needs physical presence or a position inside your network. SecureRoot has no offices outside India.
Every engagement starts with a written scope and a fixed price. Our published price bands are shown in rupees with US dollar figures for overseas buyers, and where a client is outside India the data-transfer terms are set in the contract.
Licensing. Singapore and Malaysia both license penetration-testing providers. Penetration testing is not offered through this site to organisations in either market. Ask us before enquiring about any other service there.
Services
What we deliver, and what we do not
- Web application, API and mobile testing
Manual testing of the systems you expose, reported with proof of concept, CVSS v4.0 scores and a retest.
- Cloud security
A cloud penetration test, or a configuration review against the CIS Benchmarks, on read-only access.
- Secure code review and software composition analysis
Findings at file and line with a fix; secret handling is reviewed as part of code review.
- SOC 2 readiness
Readiness and audit support. The SOC 2 report itself is issued by a licensed CPA firm, not by SecureRoot.
- ISO/IEC 27001 implementation
Building the ISMS to certification readiness. The certificate is issued by an accredited certification body, not by SecureRoot.
Local rules
Where regulators set testing and security expectations
The markets below have the most specific rules we have verified at source. Each links to its entry in the coverage directory, which lists every country and market in the region. Summaries are not legal advice.
Australia
- Privacy Act 1988 (Cth), APP 11 and Notifiable Data Breaches scheme (Office of the Australian Information Commissioner (OAIC))
- Privacy and Other Legislation Amendment Act 2024 (OAIC)
- Cyber Security Act 2024 (Department of Home Affairs / National Cyber Security Coordinator (unverified which body administers each Part))
Singapore
- Personal Data Protection Act 2012, Part 6A data breach notification (Personal Data Protection Commission (PDPC))
- PDPC Guide to Data Protection Practices for ICT Systems (PDPC)
- Cybersecurity Act 2018 (amended 2024) (Cyber Security Agency of Singapore (CSA) / Commissioner of Cybersecurity)
Malaysia
- Personal Data Protection Act 2010 (Act 709) as amended 2024, s12B data breach notification (Personal Data Protection Commissioner (JPDP))
- Cyber Security Act 2024 (Act 854) (National Cyber Security Agency (NACSA))
- Cyber Security (Licensing of Cyber Security Service Provider) Regulations 2024 (NACSA)
Hong Kong SAR
- Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) (Commissioner of Critical Infrastructure (Computer-system Security); designated authorities including the HKMA for designated banks)
- Cybersecurity Fortification Initiative 2.0: Cyber Resilience Assessment Framework (C-RAF 2.0) and iCAST (Hong Kong Monetary Authority (HKMA))
Japan
- Act on the Protection of Personal Information (APPI), as amended (Personal Information Protection Commission (PPC))
- Guidelines on Cybersecurity for the Financial Sector (Financial Services Agency (FSA))
Bangladesh
- Cyber Security Act, 2026 (Act No. 81 of 2026) (National Cyber Security Agency (Director General) and National Cyber Security Council)
- Personal Data Protection Act, 2026 (Act No. 63 of 2026) (Authority under the National Data Management Act, 2026 (authority name and status unverified))
- Bangladesh Bank Guideline on ICT Security, Version 4.0 (2023) (Bangladesh Bank)
Sri Lanka
- Banking Act Directions No. 16 of 2021: Regulatory Framework on Technology Risk Management and Resilience for Licensed Banks (Central Bank of Sri Lanka)
- Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025 (Data Protection Authority of Sri Lanka)
Guides and help
Before you scope an engagement
- Cloud Security Assessment: Scope, Access and Deliverables
Cloud configuration review vs penetration test: what is in scope, the read-only access you provide, AWS, Azure and Google Cloud rules, and deliverables.
- How to Scope a Web Application and API Penetration Test
Scope a web app and API pentest: hosts, API specs, roles and tenants, staging or production, cloud provider rules, exclusions and rules of engagement.
- Planning a Combined SOC 2 and ISO 27001 Programme
How to plan SOC 2 and ISO 27001 together: one control set, a mapping, sequencing, evidence reuse, two independent assessors, and where they differ.
- Help centre
What to send for a proposal, preparing test accounts, findings and retests, and SOC 2 and ISO 27001 preparation.
Primary Sources
Where the Figures on This Page Come From
Every deadline, threshold and control count above is taken from the instrument itself. These are links to the primary text, not to a summary of it.
- Cybersecurity Services Regulation Office (CSRO), frequently asked questions on licensing
Cyber Security Agency of Singapore · Link checked 2026-11-12
- Cyber Security (Licensing of Cyber Security Service Provider) Regulations 2024, P.U.(A) 221
National Cyber Security Agency (NACSA), Malaysia · Link checked 2026-11-12
Discuss an APAC security programme
Tell us where your organisation and your systems are, what you need tested or prepared for, and who is asking for it. We will tell you whether and how we can help, and anything that needs settling first.