Compliance Certifications and Privacy Programmes

Start with the one a customer or a regulator is already asking for, because that is the one with a deadline attached. In practice that means SOC 2 if you sell to US buyers, ISO 27001 if you sell to European or enterprise Indian buyers, PCI DSS if you touch cardholder data, and the DPDP Act if you process the personal data of people in India, which is not optional and does not wait for a customer to ask. If nothing is blocking a deal, ISO 27001 is usually the better first move, because its management system is the thing later frameworks plug into rather than duplicate. What we advise against is picking whichever looks easiest. A certificate nobody asked for costs the same to maintain as one that closes revenue. We work out which is actually in front of you during scoping.

Yes, and it usually costs less than running them in sequence, because the control sets overlap far more than the documents suggest. Access control, change management, logging, vendor management, incident response and business continuity all appear in ISO 27001, SOC 2 and the DPDP Act in different language but resting on the same evidence. We map your controls once, then show which framework each piece of evidence satisfies, so an access review you already run for SOC 2 is not rebuilt from scratch for ISO 27001. The saving is real without being total: each framework keeps its own mandatory artefacts, its own auditor and its own timeline. The pattern that works is one anchor framework built properly, then the second layered onto it within the same year. We tell you honestly how much of the second is already done.

No, and no consultancy can. ISO 27001 certificates are issued by an accredited certification body, and SOC 2 reports are issued by a licensed CPA firm. Those bodies have to stay independent of whoever built the programme, so the same firm cannot both implement your controls and attest to them. We do the readiness work: scope, gap assessment, risk treatment, control design, documentation, internal audit and evidence, then we sit alongside you through the audit itself, answer the auditor's questions and help you close findings. We will introduce you to registrars and audit firms we have worked with, and you contract with them directly. Treat anyone offering a certificate inside a bundled price with caution, because a certificate from a body that is not accredited is worth very little to the customer who asked you for one.

One call, usually 30 to 45 minutes, with the people who will do the work. Bring whatever started this: the customer questionnaire, the auditor's email, the clause in a contract, or the regulator's deadline. Tell us what you run, where your data sits and who already owns security internally. We work out which framework answers the question actually in front of you, what the scope should cover and what can safely stay outside it, then send you a written scope, a phase by phase timeline and a fixed price. The price is fixed after scoping, never before, so it does not grow later the way an open ended estimate does. If your problem is smaller than a full programme, or you are further along than you thought, we say so on the call rather than selling you a phase you do not need.

A working management system and the evidence that proves it runs, rather than a folder of templates. Depending on the framework that means a defined scope, a gap assessment you can act on, a risk assessment and treatment plan, the policy and procedure set the standard requires, a Statement of Applicability where ISO 27001 applies, internal audit and management review records, and the evidence trail an auditor samples from. For privacy work it also means a data inventory and flow map, a consent and notice framework, a data principal rights playbook and a breach response procedure. All of it is written to fit how your teams actually work, because a control nobody follows fails the audit that tests operation rather than design. You own the output, it lives in your own systems, and it stays usable after we leave.

The certificate starts a cycle rather than ending a project. ISO 27001 runs on a three year cycle, with surveillance audits in the intervening years and a full recertification at the end, and each one asks for evidence that the management system kept operating. SOC 2 reports cover a point in time or a period, so buyers expect a fresh one every year with no gap between windows for them to ask about. The DPDP Act has no certificate at all, which means the programme itself is your evidence and it has to hold up whenever a regulator or a customer asks. What keeps this alive is unglamorous: access reviews on schedule, the risk register genuinely reviewed, incidents logged and closed, management review actually held. We stay on through the surveillance and annual cycles, or hand over with a calendar of what falls due when.