GRC consulting
Governance, risk and compliance, sized to your business.
Policies, risk management and compliance programmes that satisfy regulators and customers without slowing the business.
Why teams call us
Problems this solves
-
01
Several frameworks at once
Customers want SOC 2, the board wants ISO 27001, the regulator has its own rules.
-
02
Vendors with access to your data
No clear view of which suppliers hold what data, or how secure they are.
-
03
Risk discussed, never recorded
Decisions about risk are made informally and cannot be shown later.
-
04
New privacy obligations
India's DPDP Act 2023 and US state privacy laws add new duties.
Our approach
GRC is how an organisation decides what security and compliance it needs, records the risks it accepts, and proves it does what it says. We build a programme that maps your obligations once, so one control can satisfy several frameworks, and keeps the paperwork proportionate to your size.
We work with requirements such as the Digital Personal Data Protection Act 2023, CERT-In directions, RBI and SEBI cybersecurity expectations for regulated entities, SOC 2, ISO/IEC 27001 and US state privacy laws. We describe how we help you meet them; responsibility for compliance stays with your organisation.
What is included
-
Policy framework
A concise, consistent set of security and privacy policies.
-
Risk register
Risks identified, owned, rated and reviewed.
-
Control mapping
One control mapped to several frameworks to avoid duplicate work.
-
Vendor risk management
Supplier inventory, assessments and contract clauses.
-
Compliance calendar
Reviews, audits, renewals and reporting deadlines tracked.
-
Board reporting
Clear reports on risk and compliance status.
What you receive
- Obligations register
- Policy set
- Risk register and treatment plan
- Control and framework mapping
- Vendor risk process
- Compliance calendar
Technology we work with
- DPDP Act 2023
- CERT-In Directions 2022
- ISO/IEC 27001
- SOC 2
- NIST CSF 2.0
- CCPA / CPRA
Industries
How an engagement runs
Every engagement starts with a signed agreement and an advance payment as set out in your proposal. Work begins once both are complete.
-
01
Map obligations
Laws, regulations, contracts and frameworks that apply to you.
-
02
Assess
Current controls and gaps against those obligations.
-
03
Build
Policies, risk processes and controls put in place.
-
04
Run
Ongoing reviews, reporting and updates as rules change.
Ready to start? Talk to us directly.
Tell us what you need in a few lines. A specialist replies with next steps and a written proposal before any work begins.
Frequently asked questions
Can't find your answer? Ask us
Are you a law firm?
Can one programme cover several frameworks?
Do you help with the DPDP Act?
Start with a conversation.
Share a few details. A specialist replies with next steps, usually starting with a short call.