Cybersecurity & Compliance Services

Which framework applies to you

Most organisations arrive here knowing they have a compliance requirement but not which one, often because a customer or a tender asked for something specific. The obligation usually follows from the data you hold and who you sell to:

• Personal data of people in India — DPDPA applies by law rather than by choice, and it applies to organisations of every size.
• Health information for US entities — HIPAA, typically reaching Indian providers through a business associate agreement in a client's vendor review.
• Card payments — PCI DSS, with the validation route set by how you handle card data and your transaction volume.
• Selling software to enterprise or US buyers — SOC 2 is usually what procurement asks for, and increasingly early in the sales cycle.
• A certifiable management system, often for tenders — ISO 27001, the one most widely recognised in procurement.
• Containers and Kubernetes in production — container security, which cuts across the frameworks above rather than replacing any of them.
• More than one of the above — a unified GRC programme, so the overlapping controls are built and evidenced once.

Compliance and security are not the same thing

It is worth being direct about this, because conflating the two is expensive in both directions. A framework establishes that a set of controls exists and operates. It does not establish that an attacker cannot get in, and organisations are breached while holding current certifications.

The two answer different questions. Compliance asks whether you can demonstrate control to a third party; security testing asks what someone determined to get in would actually find. A penetration test finds the misconfigured service, the forgotten subdomain and the exposed interface that no checklist asks about, and those are the findings that matter operationally even when every control is marked satisfied.

In practice the sequence that works is to scope the obligation first so effort is not spent on systems that were never in scope, build the controls once against a mapped control set, then test adversarially and feed what the test finds back into the programme. Treating certification as the finish line is how an organisation ends up compliant and exposed at the same time.

Not sure what you need?

Tell us your problem — we'll recommend the right solution and brand for your budget.