Do you offer SOC 2 or ISO 27001 readiness consulting?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

How is ISO 27001 readiness different from a penetration test?

Different question, different evidence. A penetration test asks whether an attacker can break a specific system, and produces attack paths. ISO 27001 asks whether the organisation has a management system that identifies risk, assigns ownership, controls access, reviews its own controls and demonstrates continuous improvement, and produces a certified ISMS with a Statement of Applicability, a risk treatment plan and internal audit records. A penetration test can be one of the technical controls inside that system, and it is evidence for one clause, not a substitute for the system. In India the two are increasingly bought together, because a customer questionnaire that asks for SOC 2 also asks for recent test evidence.

What does SOC 2 preparation actually involve?

Four workstreams, done in sequence. First, scoping: which Trust Services Criteria apply to your service, which systems are in the boundary, and whether the customer expects Type I, covering a period, or Type II, covering both a period and the operating effectiveness of controls. Most Indian vendors start with Type I. Second, gap analysis against the criteria, producing a gap register with an owner and a date per control. Third, remediation: writing policies, access control, change management, vendor risk, incident response and the evidence-collection routine. Fourth, an observation period for Type II, during which evidence accumulates automatically. Total elapsed time is typically 3 to 6 months, largely because the observation period is calendar-bound.

Which one should an Indian company choose first?

Start with ISO 27001 if your clients, regulators or tender documents ask for a certified standard, because it is a recognised international certification with a defined certification body process, and because the ISMS it forces you to build also covers the CERT-In and DPDP obligations you already have. Start with SOC 2 if your customers are US software companies or enterprise buyers who name SOC 2 in a security questionnaire, because that is a contractual expectation rather than a regulatory one. Some Indian companies run both, ISO 27001 first, because the ISMS supplies most of the evidence a SOC 2 audit needs, which makes the second project faster and cheaper.

How long does readiness consulting take, and what does it cost?

ISO 27001 readiness typically runs 6 to 12 weeks of consulting before the certification audit, and SOC 2 preparation 3 to 6 months including the observation period for Type II. The cost depends entirely on how many systems and locations are in scope and how far your current controls are from the standard, and it is quoted as a fixed project fee rather than hourly, because the work is well defined. A useful expectation to set: readiness consulting produces everything an auditor can check, but it cannot produce the certificate itself, because certification must be issued by an accredited third-party certification body after an independent audit.

What are the frequently asked questions?