Compliance
Testing that stands up to your auditors
Most security frameworks require independent testing. Our reports are structured so you can hand them straight to an auditor, regulator or enterprise customer.
| Framework | What it asks for | How we support it |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 8.8 (management of technical vulnerabilities) and 8.29 (security testing in development and acceptance). | Penetration testing and vulnerability assessment reports serve as evidence for both controls. |
| SOC 2 | Common Criteria CC4.1 (monitoring activities) and CC7.1 (detecting vulnerabilities). | An annual independent penetration test is standard evidence auditors expect to see. |
| PCI DSS v4.0 | Requirement 11.3 (internal and external vulnerability scans) and 11.4 (penetration testing). | Quarterly vulnerability assessments plus an annual penetration test, including segmentation testing. |
| RBI IT Governance Directions | The Master Direction on IT governance, risk, controls and assurance practices (2023) expects regular VA/PT. | Testing and reports structured to support regulated entities' assurance requirements. |
| SEBI CSCRF | The Cybersecurity and Cyber Resilience Framework (2024) requires periodic VAPT for regulated entities. | VAPT scoped to your entity category, with reports formatted for submission. |
| DPDP Act, 2023 | Data fiduciaries must take reasonable security safeguards to prevent personal data breaches. | Testing shows those safeguards work. Forensics supports breach investigation and response. |
| CERT-In Directions (2022) | Specified cyber incidents must be reported to CERT-In within six hours. | Our digital forensics team helps you investigate and assemble the facts needed to report. |
Audit-ready reports
What every report includes
Scope & dates
Exactly which systems were tested, from where, and when, so auditors can match them to your asset register.
Methodology
The standards followed (OWASP, PTES, NIST) and the testing approach used.
Severity ratings
CVSS scores adjusted for business context, with a clear rationale for each rating.
Evidence
Screenshots and request logs for every finding, with sensitive data redacted.
Remediation
A specific fix for each issue, and the retest status once it's resolved.
Attestation letter
A short letter confirming the test and its outcome, safe to share with customers.
Find out where you're exposed before an attacker does.
Tell us what you need tested. We'll reply within one business day with questions or a fixed quote.