Every new customer brings a new framework
SOC 2 got you the first tier of buyers. Now Europe wants GDPR, India wants DPDP, healthcare wants HIPAA, and each one is being run as its own project with its own evidence.
By company size
One programme, not five parallel ones
Standardize controls as tools, teams, and regions expand
You have the first certificate. Now there is a second framework, a new region, three more cloud accounts and a headcount that doubled. The work is no longer getting certified — it is keeping one coherent programme while everything underneath it changes.
Where you are
The constraints at this stage
What tends to be true when companies come to us at this size.
The estate grew faster than the controls
More cloud accounts, more SaaS, more repositories, more contractors. The control set was designed for the company you were two years ago and nobody has re-scoped it since.
Compliance has become a tax on shipping
Evidence requests arrive from several directions, teams answer the same question three ways, and the audit calendar is now a permanent fixture rather than an annual event.
What we run for you
The work itself
Delivered by our specialists, not handed to you as a template pack.
GRC ProgramOne control set mapped to every framework you carry, so a control is implemented once and satisfies ISO 27001, SOC 2 and the rest simultaneously.Cloud SecurityPosture and access across AWS, Azure and GCP — including the accounts that were spun up outside the original scope.Application SecuritySecurity in the development lifecycle rather than bolted on at release: design review, testing in the pipeline, and findings that reach the team that can fix them.GDPREU data protection readiness for the customers and regions that now require it, mapped onto the controls you already run.DPDP ActIndia's data protection regime, covering consent, notice and the operational obligations that follow from them.Supply Chain SecurityWhat you inherit from vendors and dependencies — assessed, tiered and monitored, rather than a spreadsheet refreshed once a year.
How the engagement works
What actually happens
The same four beats every time, scoped to what this stage needs.
Re-scope against reality
We map what the estate actually looks like now — accounts, systems, data flows, third parties — against what the current control set assumes. The gap between those two is the work.
Consolidate to one control set
Frameworks overlap heavily. We build a single set of controls with a crosswalk to each framework, so one implementation and one piece of evidence serve all of them.
Automate the evidence
Recurring evidence moves onto a schedule with named owners, so audit preparation stops being a quarter-end scramble across several teams.
Run the audit calendar
Surveillance audits, Type II windows and new certifications get sequenced into one calendar rather than colliding, and we carry each of them.
Proof
Track record
Across every engagement we have run, at every size.
0+
Companies Secured
Zero
Failed Audits
4-8
Weeks to Compliance
0+
Team Certifications
What you walk away with
The artefacts
Everything below is a thing you own at the end, not a promise about the process.
- A current-state map of systems, data flows and third parties
- One unified control set with a crosswalk to every framework you carry
- Evidence collection on a schedule, with a named owner per control
- A remediation plan prioritised by risk rather than by framework
- Cloud and application security assessments with retests
- A vendor register with tiering and review cadence
- A single audit calendar covering surveillance, Type II and new certifications
Related
Where to go next
The problems this stage usually arrives with, and the services behind them.
Questions
What people ask at this stage
Far less than the first one. The two overlap substantially, so most of the work is the ISO-specific machinery — scope, risk assessment, Statement of Applicability, internal audit and management review — rather than re-implementing controls you already run.
Yes. We are not selling a platform, so there is nothing to migrate onto. We work with your existing stack, and where a compliance tool is already in place we operate it rather than replacing it.
Data protection obligations are mapped per region onto the same control set — GDPR for the EU, DPDP for India, and so on. The controls are shared; the notices, consent flows and records differ, and those are handled per jurisdiction.
You can keep it in-house with us implementing, or hand the operating function to us through Compliance as a Service. Most companies at this stage split it: internal ownership of decisions, external delivery of the work.
Stop running five programmes.
Tell us which frameworks you carry and which are coming. We will show you how much of it is the same control implemented five times.