Co-working · Two Indian cities
Data privacy readiness
16weeks
Programme scoped in four phases, from ownership to go-live
24business hours
Reply time for queries in the data protection officer retainer
Secure · Governance, risk and compliance
Compliance in order, before the audit asks.
Governance, risk and compliance services for Indian organisations whose customers, regulators or auditors ask for evidence. NetScale runs ISO 27001, ISO 27701, GRC frameworks and enterprise risk management as one programme, with the evidence kept current between audits. Runbooks, policies and audit evidence are handed over as yours.
- Services
- ISO 27001, ISO 27701, GRC frameworks, enterprise risk management
- Platforms
- Arcon, Proofpoint, Seqrite, Microsoft Azure
- First step
- A free gap assessment, findings in writing
- Last updated
Secure · Governance, risk and compliance
Sound familiar? How we answer.
Governance, risk and compliance (GRC) is how an organisation sets its rules, manages its risks and proves it meets the standards and laws that apply.
Certification was pursued to win contracts. The auditor now asks for evidence. How long does it take to produce?
ISO 27001:2022Information security management system implementation and audit to the current standard, with evidence kept current between audits.
Personal data was collected to serve customers. Years later it is still there. Who decided when it gets deleted?
ISO 27701:2025 privacy managementPrivacy information management system implementation and audit, aligned to DPDP and data protection requirements.
Policies were written to pass the last review. They sit in a folder. Who checks they are followed today?
Governance, risk and compliance frameworksGovernance policies, risk processes and compliance requirements integrated into one system, instead of three run in parallel.
Vendors were given access to get work done. Their breach becomes yours. Whose risk register are they on?
Enterprise risk management (ERM)Risks identified, assessed and mitigated across every level and business function, vendors included.
Also in this line:DPDP readiness
Secure · Governance, risk and compliance
Work we can show you.
Client names and the full write-up of any engagement are shared in conversation.
Education technology · Laptops across departments
Device security health check
1week
One working week to find out what was on the laptops
2weeks
The fix plan’s last actions due
Your stack is our stack.
Our partners build the platforms; we make them work as one environment, with direct escalation into every vendor’s support organisation.
Questions buyers ask about this.
Related services
Can ISO 27001, ISO 27701 and DPDP run as one programme?
Yes. The two standards share a management system, a risk process and much of their evidence. The DPDP Rules’ technical duties map onto the same controls. We build one control set, one risk register and one evidence store. Then we add what each requirement asks for on its own.
Where should we start with governance, risk and compliance?
With what someone is already asking you for. If a customer wants ISO 27001, start there. If DPDP is the pressure, start with ISO 27701 and the data map. The gap assessment shows which comes first and what the rest would add. It is free, and the findings are yours either way.
What is the difference between GRC and ERM?
GRC is the whole system: policies, the risk method and compliance evidence. Enterprise risk management (ERM) is the risk part, run across the business. It keeps one register of what could go wrong in every function, vendors included, with each risk owned and tracked. A GRC framework draws its risks from that register.
What do we keep if we stop?
Everything built so far. Runbooks, policies and audit evidence are handed over as yours, and you keep them whether or not we stay. Each phase is fixed-scope and signed off separately, so you can stop at any phase boundary with a working system and its records in hand.
Secure · Governance, risk and compliance
Related guides.
Book a gap assessment.
It costs nothing and commits you to nothing. You get a written list of where your IT environment is exposed, and your team can act on it with or without us.
What we put in writing
- The written findings are yours whether we ever work together or not.
- Each phase is fixed-scope and signed off separately.
- You can stop at any phase boundary.
- Runbooks, configurations and credentials are yours.