Compliance and security guides

Plain-language answers to the questions companies ask most about compliance and security testing.

ISO 27001

What the international information security standard asks for, the 93 Annex A controls, the certification steps and how long it takes.

SOC 2

The five Trust Services Criteria, Type I versus Type II, and how SaaS companies selling to the US prepare for the audit.

DPDP Act 2023 (India)

Who India's data protection law applies to, consent and notice, children's data, breach reporting, penalties and a starter checklist.

ISO/IEC 42001

The certifiable standard for managing AI responsibly: who needs it, what it requires and how to start.

NIST AI RMF and the OWASP LLM Top 10

The four functions of the NIST AI Risk Management Framework and the ten most common security risks in apps built on large language models.

PCI DSS

The 12 requirements of PCI DSS v4.0.1, SAQ versus ROC, what changed in version 4 and how to reduce your scope.

VAPT

The difference between a vulnerability assessment and a penetration test, how often to test, what regulators in India expect and what to do with the findings.