Assessments
Compliance & Certification Readiness
Compliance readiness for SOC 2, ISO 27001, PCI DSS, HIPAA and India's DPDP Act, gap assessment, control implementation and audit-ready evidence, with support through the auditor's review.
Scope
- HIPAA: safeguards review and risk analysis for handlers of health data
- PCI DSS: scoping, gap assessment and remediation toward attestation
- SOC 2: control design and evidence preparation for Type I / Type II audits
- ISO 27001: ISMS build-out, risk treatment and internal audit before certification
- Ongoing evidence collection habits so the next audit is cheaper than the first
Method
Gap assessment against the target framework first, then hands-on help implementing the missing controls: policies, technical safeguards and monitoring. Certification itself is issued by accredited auditors; we prepare you and support you through their audit.
Deliverable
A control-by-control gap report, a prioritised remediation plan with owners, and audit-ready evidence, plus support alongside your auditor or QSA until the certificate or attestation is in hand.
Approach
How we work
01
Scope
Every engagement starts with a scoping conversation and ends that conversation with a written agreement: your target framework or the systems and environments in scope, what is explicitly out, which accounts and data we will use, and the timeline.
02
Assess
We measure where you stand: a gap assessment against your target framework, a review of controls, policies and risk, and hands-on testing where it matters. The work is manual and methodical, guided by how the system is actually used and what an attacker would actually want from it. Tooling supports the work; it does not replace it.
03
Explain
You receive a written report and a walkthrough call. The executive summary is written for people who were not in the room; each finding carries evidence, reproduction steps, business impact and a concrete fix.
04
Verify
When your team has remediated, we retest the affected findings and issue an updated report stating clearly what is resolved, what is partially resolved and what remains open. For a certification programme, we prepare the evidence and stand beside you through the audit, then help you keep it current.
Frequently asked questions
- Do you issue the certificate?
- No, certification is issued by accredited auditors or a QSA. We run the gap assessment, implement the missing controls and prepare your evidence, then support you through their audit.
- Which frameworks do you cover?
- HIPAA, PCI DSS, SOC 2 (Type I and II) and ISO 27001, including the ISMS build-out and internal audit before certification.
- How long does readiness take?
- It depends on your starting point; we begin with a gap assessment against the target framework and give you a prioritised remediation plan with owners, so the timeline is clear up front.
Related reading
7 min read
What Is SOC 2 Compliance? A Plain-English Guide
SOC 2 explained without the jargon: what it is, the five Trust Services Criteria, Type I vs Type II, who needs it, what the process looks like, and how to prepare.
9 min read
India's DPDP Act: A Practical Compliance Guide (2025)
What India's Digital Personal Data Protection (DPDP) Act requires, who counts as a data fiduciary, what the 2025 Rules add, the penalties, and a practical path to compliance.
Other assessments
Engagements are fixed-scope and fixed-price once agreed. If you are not sure which service fits, whether that is certification readiness, GRC advisory or a penetration test, describe your situation and we will recommend a scope, including telling you honestly if you do not need us yet.