A security programme you can govern, certify and prove.

It helps an organisation build and assess governance, risk and compliance controls against ISO/IEC 27001, 27701, 22301 and 27018, NIST CSF 2.0, SOC 2, PCI DSS, HIPAA, ITGC, fraud risk and cyber maturity frameworks, and it produces a maturity scorecard, roadmap, policy framework, risk register, implementation tracker, internal audit report, readiness report and board dashboard.

No. ISO certificates are issued by accredited certification bodies and SOC 2 reports by licensed CPA firms. Codec Networks prepares organisations for those audits, supports them through the process and can help coordinate with the auditor the client appoints, but it does not issue certificates or attestation reports itself.

ISO/IEC 27001 is an international standard for an information security management system, leading to a certificate. SOC 2 is an attestation report by a CPA firm on a service organisation's controls against the AICPA Trust Services Criteria. Many customers accept either; many companies need both, and one control set can serve them.

A Type 1 report covers whether controls are suitably designed at a point in time. A Type 2 report also covers whether they operated effectively over a period, commonly several months to a year. Enterprise customers usually ask for Type 2.

A VAPT tests systems for exploitable vulnerabilities. A regulatory audit checks compliance with specific Indian regulators. This service builds and tests the management system that ties them together: governance, risk, policies, owners and evidence. Codec Networks offers VAPT and regulatory audits as separate services.

Policies are the start, not the finish. Auditors and customers look for a risk assessment that drives the controls, owners who run them and evidence that they operated. Most of the gaps we find are in those three areas, not in the policy text.

No. The certification or attestation decision always belongs to the external auditor. What Codec Networks does is reduce the chance of surprises by building what is missing and testing it the way an auditor would, before the audit.

It depends on scope, maturity and how quickly evidence and approvals arrive. A focused readiness review is much faster than a full implementation or a SOC 2 programme, which has to include an observation period. The schedule is agreed in the proposal before work starts.

Start with what your customers and regulators ask for. SaaS companies selling to US enterprises often start with SOC 2; those selling globally or to Indian enterprises often start with ISO/IEC 27001. A cyber maturity assessment is a good first step if you are not yet sure.

Yes, and it is usually more efficient. Codec Networks maps one control set to both, so policies, risk assessment, access reviews and change management are designed and evidenced once.

The scope should cover the services, systems, locations and teams your customers rely on. A scope that leaves out key systems may be easier to certify but is harder for customers to trust. The scoping workshop agrees a scope that is both achievable and credible.

Annex A was reorganised into 93 controls in four themes (organisational, people, physical and technological), with new controls such as threat intelligence, information security for use of cloud services and secure coding. The transition from the 2013 edition ended on 31 October 2025.

If you process personal data for customers or need to show privacy governance, it helps. Since October 2025 ISO/IEC 27701 can be implemented and certified on its own, though many organisations still run it alongside ISO/IEC 27001.

It may still apply, depending on how card data flows through your systems. Scoping the cardholder data environment is the first step, and reducing that scope is often the most valuable outcome.

HIPAA is US law. It applies to US covered entities and their business associates, so an Indian company that handles protected health information for US clients is usually expected to meet the Security Rule under its business associate agreements. Legal applicability should be confirmed with qualified counsel.

A list of entities, locations, systems and teams in scope; existing policies and procedures; any risk register, audit reports or customer questionnaires; the certification or report you are aiming for and its target date; and the names of a sponsor, a coordinator and control owners.

Yes, if that is in scope. Codec Networks drafts or refines policies and procedures for the frameworks in scope, and your owners adapt and approve them so that they match how your teams really work.

It is the ISO/IEC 27001 document that lists each Annex A control, whether it applies, why, and whether it is implemented. A good one follows from the risk assessment; a copied one is one of the first things auditors question.

We agree a method with you, then identify assets and processes, the threats and vulnerabilities that affect them and the controls already in place, and rate each risk for likelihood and impact. The result is a risk register with treatments, owners and residual risk targets.

Anything that shows a control operated: approved tickets, access review records, training records, backup and restore logs, meeting minutes, screenshots, system reports and signed documents. The evidence index lists what each control needs and where it is kept.

Partly. Tools can collect configuration and log evidence, and we encourage it. But someone still has to design the controls, review exceptions and judge whether a control is effective. Our internal audit checks what the tools report.

For most work we review documents and evidence you provide. Where technical evidence is needed, we use read-only access or supervised walkthroughs agreed in advance.

It varies with scope and maturity. The biggest demands are on control owners during the build phase and on the coordinator throughout. A clear RACI agreed at kickoff keeps the effort predictable.

Codec Networks is certified to ISO/IEC 27001:2022. Access is limited to the engagement team, documents are kept in controlled repositories, evidence is used only for assessment and reporting, client data is not uploaded to public AI tools without written approval, and retention and deletion follow the agreed terms.

A maturity scorecard, compliance roadmap, policy framework, risk register, control implementation tracker, internal audit report, certification readiness report, board dashboard and evidence index, plus closure validation where it is in scope. The working documents are delivered in editable form.

On a six-point scale from 0 (not implemented) to 5 (optimised), applied the same way to every domain and framework. Each score is backed by evidence, so the board sees the same measure every year.

ISO management system standards require internal audits and management reviews before certification and throughout the cycle. Codec Networks performs internal audits that test controls on samples, so nonconformities are found and fixed before the certification body visits.

A rehearsal of the external audit: interviews, evidence requests and challenge in the style of a certification body or CPA firm, followed by a management presentation. It is an optional add-on.

Codec Networks helps you understand the finding, plan corrective action and gather closure evidence. Closure validation can be included to confirm the fix before the auditor reviews it.

Reports are for your internal use. You can share them where a contract or law requires, and many clients share a summary or their certificate or SOC 2 report instead. External distribution of Codec Networks' reports needs written approval.

Yes. The board dashboard summarises maturity, top risks, readiness and investment priorities in business terms, and the readout presents them in person.

Use the same maturity scale, risk method and control set each cycle. The dashboard then shows trends: higher scores, fewer open risks, fewer nonconformities and faster closure.

No. A minimum viable ISMS, a policy framework, a risk register and a customer-ready security pack are often enough for the first enterprise deal, and they grow with you towards certification.

The cyber maturity assessment, risk register, ITGC review and board dashboard support the governance and assurance expectations of regulated entities. Specific regulatory audits against RBI, SEBI or IRDAI requirements are delivered through Codec Networks' Regulatory Cybersecurity Audit service.

Under the CSCRF of August 2024, SEBI calls for ISO/IEC 27001 certification for market infrastructure institutions and qualified regulated entities. Other categories should confirm their obligations against the framework and SEBI's clarifications.

ISO/IEC 27701 and the privacy controls in the programme help organisations prepare for the DPDP Act and Rules: security safeguards, breach readiness, retention and data principal rights, before most obligations apply in May 2027.

Yes. The fraud risk assessment reviews scenarios, control weaknesses, segregation of duties and monitoring, and produces a management action plan, which is especially useful for financial services and payment firms.

Yes. Codec Networks is empanelled by CERT-In for information security auditing services, and with NICSI for application audit and compliance services in the start-up category. It is also certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018.

A monthly or quarterly engagement that keeps the programme running between audits: evidence review, policy updates, risk register maintenance, internal audits, a board dashboard and support during audits.

Book a scoping call. We agree the frameworks, entities, systems and goals in scope and the engagement model, issue a proposal and statement of work, hold a kickoff meeting and send the document request list.