Cyber Compliance Services in India — ISO 27001, PCI DSS and DPDP

It depends on what you do and how you are registered, not on your size. Handling payment card data brings PCI DSS. Operating in India brings the CERT-In Directions regardless of sector. Regulated financial entities have sectoral frameworks whose applicability turns on their specific classification. Processing personal data brings DPDP obligations. ISO 27001 is voluntary but frequently required by customers in contract. The table above is a map to orient yourself; the answer for your organisation comes from reading the instruments against your registration.

There are two separate costs and quotes often show only the first. Consultancy covers gap assessment, the management system, policy work, control implementation and audit preparation, and scales with the scope you choose, the number of sites, headcount and how much already exists. Certification body fees are separate, are charged per audit day, and recur — surveillance audits annually and recertification periodically. Ask any provider for the total across three years rather than the first invoice, because that is the actual commitment.

ISO 27001 certifies a management system against an international standard, issued by an accredited certification body, and is the certification most commonly asked for outside the United States. SOC 2 is an attestation report produced by a licensed CPA firm under the AICPA framework, describing whether controls were suitably designed and, for Type II, operating over a period. US buyers usually ask for SOC 2 by name; buyers elsewhere usually ask for ISO 27001. They overlap substantially in underlying control work, which is why organisations pursuing both should map once and evidence once.

A structured comparison of what a framework requires against what your organisation actually does — ideally assessed against evidence rather than against documentation. The output is a prioritised remediation plan with owners and effort estimates. Assessing policies tells you what you have written down; assessing evidence tells you what is operating, and only the second predicts an audit outcome.

CERT-In Direction 20(3) of 2022 requires organisations to maintain logs of their ICT systems for a rolling period of 180 days, and to maintain them within India. In practice that is a configuration and architecture decision affecting your SIEM, your cloud regions and your retention tiers rather than a policy question. Incident reporting duties sit alongside it — the deadlines across the various Indian regulators are set out on our cyber incident reporting page, which is kept current.

Broadly: knowing what personal data you hold and why, having a lawful basis and notice, honouring the rights the Act gives individuals, securing the data, retaining it no longer than needed, and being able to demonstrate all of that. Commencement is phased and several obligations are not yet in force, so the practical answer is to build the data inventory and the retention position now — those take longest and are useful regardless — and verify current commencement before committing to a date-driven plan.

Usually yes, but at dramatically reduced scope. If card data never touches your systems, most requirements fall away and your obligation becomes largely about validating that separation and completing the appropriate self-assessment. This is the clearest example of a general principle: reducing scope is nearly always cheaper than securing it.

Internally is entirely possible and is cheaper if you have someone who has done it before and can protect the time. What consultants genuinely add is pattern recognition — knowing which evidence auditors actually ask for, which controls fail in practice, and where a scope decision will cost you later. What they should not add is a set of template policies describing an organisation that is not yours.

From a standing start, typically several months rather than weeks, and the constraint is almost never writing the documents. Certification requires evidence that the management system has been operating — internal audits performed, a management review held, risks assessed and treated, incidents handled. That evidence accrues over time and cannot be manufactured retrospectively, which is the single most common reason timelines slip.

Partly, and it depends entirely on scope. A questionnaire usually asks about the systems handling that customer’s data. If those systems sit inside your certified scope, the certificate answers a great deal. If they do not, it answers very little and the mismatch is discovered at exactly the wrong moment. Check the scope statement before relying on it.

Yes, and it is usually the sensible order. Control overlap between ISO 27001, sectoral requirements and internal policy is substantial, so the efficient approach is to map controls once, implement once, and evidence once against multiple frameworks. Treating each as an independent project means paying repeatedly for the same work.

Dated artefacts showing a control operated during the period under review: access review records with the reviewer and date, change approvals, patch reports, incident tickets with timelines, backup restore tests, training completion, supplier reviews, internal audit reports and management review minutes. Not policies. The policy explains what should happen; the evidence shows it did.

Surveillance audits recur, and recertification comes round on its own cycle. Meanwhile the business changes, scope drifts, and whoever was collecting the evidence moves on. Programmes rarely fail at certification — they lapse in year two. Deciding who owns evidence collection as a standing responsibility is the single most useful thing to settle before you certify.

No, and nobody providing consultancy can. Certification is issued by an accredited certification body, and that separation is deliberate — the same organisation cannot both build your management system and independently certify it. We prepare you, we can be present for the audit, and the certificate comes from an accredited body you appoint.