Help centre
Requesting a Combined Security Testing and Compliance Engagement
Tell SecureRoot both needs at once: which framework you are working towards, who is asking and by when, and which applications, APIs, networks or cloud accounts are in scope. SecureRoot scopes ISO 27001, SOC 2 and DPDP Act readiness and the penetration testing that evidences them together, from one control set and one evidence base, and quotes one fixed price against a written scope after a 30 to 45 minute scoping call. The certification body or CPA firm stays separate: they must be independent of whoever built the controls, and you contract with them directly.
About this help article
Written by SecureRoot Risk Advisory LLP.
Before the call
What to send
You do not need everything before the first call, but the more of this you send, the more of the call goes on decisions rather than discovery.
- The trigger: the customer questionnaire, tender clause or auditor's question that started this, and the date it needs an answer.
- The framework or frameworks: SOC 2 (and whether a customer has named Type 1 or Type 2), ISO 27001, the DPDP Act, or more than one.
- What you run: the products, environments, cloud accounts and teams the compliance scope would cover.
- Web applications: target URLs, the environment they sit in, and the user roles you want covered.
- APIs: an OpenAPI or GraphQL schema, a Postman collection or captured traffic, plus how many tenants and authentication schemes exist.
- Mobile applications: Android, iOS or both, and the backend they talk to.
- Networks: external or internal, the address ranges and hostnames you own, and who can authorise testing them.
- Cloud: which accounts or subscriptions, and whether you want a configuration review as well as a test.
- A named technical contact we can reach while testing runs.
Test accounts are provisioned after scoping, not before. Access-control testing needs at least two accounts at different privilege levels, and for an API ideally two per role across two tenants; our guide to preparing test accounts and staging covers this.
Scoping
How SecureRoot scopes the combined work
- 01
Scoping call, 30 to 45 minutes
With the people who will do the work. We map the framework requirements to the systems the auditor will ask about, agree targets, environments, roles and off-limits actions, and say plainly if we are not the right fit.
- 02
Written scope
One page: what is in, what is out and what you supply. Testing is timed to your audit window and scoped to the systems the certification body or CPA firm will examine.
- 03
One fixed price
Quoted in writing against that scope, never before it. A combined engagement is one scoping call, one written scope, one fixed price and one accountable team.
- 04
Rules of Engagement and change control
Testing starts from a Rules of Engagement document both sides sign. If the scope grows later, SecureRoot re-quotes the difference rather than adding it quietly.
Deliverables
What you receive
- Testing: a findings report with proof of concept for every issue, an executive summary, remediation guidance, a verified retest report and an attestation letter. The retest is inside the price.
- Critical findings reported within three hours of discovery, not at the end of the engagement.
- Compliance: the phase documents for your framework, such as a readiness assessment report and control matrix for SOC 2, or a gap assessment, risk treatment plan and Statement of Applicability for ISO 27001, and support through the assessor's fieldwork.
- One evidence base, so a test report and its retest are filed as evidence for the controls they support.
Budget
Published bands and what sits outside them
Penetration testing is ₹50,000 to ₹4 lakh per surface, retest included. SOC 2 readiness and audit support is ₹1.5 lakh to ₹4.5 lakh, the same band for either report. ISO 27001 is ₹1.5 lakh to ₹8 lakh as a total to certificate, the certification body's audit included. Cloud, thick client and configuration reviews are quoted with the scope. The CPA firm's fee, a compliance platform's subscription and your team's time sit outside SecureRoot's quote. See the pricing page for each band in full.
Scope boundaries
What this does not cover
- SecureRoot is not a CPA firm, not an accredited certification body, not a QSA and not CERT-In empanelled. It prepares you for those assessments and does not issue reports, certificates or validations.
- Internet-facing testing is delivered remotely. SecureRoot has no offices outside India.
- Nothing is tested without written authorisation, and systems you cannot authorise stay out of scope.
- Neither the testing nor the readiness work guarantees certification, an unqualified report or compliance.
Primary Sources
Where the Figures on This Page Come From
Every deadline, threshold and control count above is taken from the instrument itself. These are links to the primary text, not to a summary of it.
- 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with revised points of focus, 2022)
AICPA and CIMA · Link checked 2026-11-12
Related
Services and help that go with this
- Information needed for a VAPT proposal
The testing-only intake, surface by surface.
- Preparing test accounts and staging
Accounts, roles and environments before testing starts.
- Planning a combined SOC 2 and ISO 27001 programme
When both frameworks are on the list.
- Web application VAPT
- API VAPT
- Cloud VAPT
- Cloud security configuration review
- SOC 2 readiness and audit support
- ISO 27001 certification services
- Pricing
Bands, retest policy and third-party fees.
Send both needs in one request
Tell SecureRoot the framework, the deadline and the systems in scope, and we will book a scoping call and quote the combined engagement in writing.