Secure · Governance, risk and compliance
A governance, risk and compliance (GRC) framework for Indian organisations that answer to several standards, laws and customer contracts at once. NetScale reviews the policies, risk process and requirements in place, maps them to one control set and keeps its evidence current. Each phase is fixed-scope and signed off separately.
GRC Frameworks
A governance, risk and compliance (GRC) framework runs three jobs as one system: policies and their owners, how risks are found and treated, and the evidence that each requirement is met.
Integrated means one control set for every requirement: ISO 27001, ISO 27701, the DPDP Rules, SEBI’s framework and customer contracts. An access review done once then counts for every requirement that asks for one.
It is not a software product. The policies, the risk method and the requirements map are documents your team owns, reviewed on a schedule agreed in writing.
The technical security design sits under Security architecture and GRC.
The enterprise risk register sits under Enterprise risk management (ERM).
A single ISO 27001 certificate, from gap assessment to audit, sits under ISO 27001:2022.
Policies were written to pass the last review. They sit in a folder. Who checks they are followed today?
Our answer: Continuous monitoring
ISO, DPDP and customer audits ask for the same evidence. Who collects it each time?
Our answer: Compliance framework setup
Each policy names an owner. How many of those owners still work here?
Our answer: Policy framework
The disaster recovery plan was written for an audit. Who has tested it since?
Our answer: Disaster recovery planning
Governance policies, risk processes and compliance requirements integrated into one system, instead of three run in parallel.
Security, privacy and acceptable use policies written once, each with a named owner, a review date and the control that shows it is followed.
ISO 27001, ISO 27701, the DPDP Rules, the CERT-In Directions and customer contracts mapped to one control set, so each control is evidenced once.
One method for finding, rating, treating and accepting risk, written down and used by every function and every audit.
Scans, findings and fixes tracked to closure on a schedule, with each closed finding filed as evidence.
Controls, access and logs checked on a schedule agreed in writing, so evidence builds up between audits instead of being gathered before each one.
Recovery objectives agreed with the business, the plan written and tested, and each test written up as evidence.
One management system, drawn three times.
You can stop at any phase boundary. The assessment is free, and each phase is priced in writing before it starts.How we engage
One control set, several Indian requirements. The DPDP Rules, the CERT-In Directions of April 2022 and SEBI’s framework for regulated entities often ask for evidence of the same control. Each is mapped once.
Listed cyber incidents must be reported within 6 hours of noticing them, and logs kept for a rolling 180 days within India. The framework names an owner for each duty in writing.
The substantive duties of the Rules apply from 13 May 2027. The requirements map tracks each duty against the control that evidences it.
Which requirements apply to you, and how a regulator reads them, is for your counsel.
Requirements in scope: the standards, laws and customer contracts the control set must answer.
Policies: how many exist, and how many need an owner or a rewrite.
Business functions and sites the framework covers.
Review schedule: how often controls, policies and evidence are checked after go-live.
The most relevant engagement, with its numbers. Client names and the full write-up are shared in conversation.
Education technology · Laptops across departments
How an online learning company found out what was really on its laptops, in one working week.
Our own information security and privacy management systems, run under both standards.
Certifications and technologyA GRC framework is one set of policies, risk methods and controls that answers every requirement you face at once. Governance says who owns what. Risk management says what could go wrong and what is done about it. Compliance shows, with evidence, that each standard, law and contract is met.
It adds the requirements ISO 27001 does not cover, mapped onto the controls you already run. The DPDP Rules, the CERT-In Directions, sector frameworks and customer contracts each ask for evidence. The framework maps each requirement to an existing control where one exists, so the evidence is collected once and reused.
By tying each policy to a control and a check. Every policy has a named owner and a review date. Each rule in it maps to a control whose evidence is collected on a schedule agreed in writing. When a check fails, it is logged and tracked to closure like any other finding.
Not to start. A framework is the policies, the risk method and the requirements map; software only stores them. A register and well-kept documents are enough to begin with. If you outgrow them, the framework moves into a GRC tool unchanged, and we will tell you when that point comes.
It is part of governance: the plan is a policy with an owner, a test schedule and evidence. ISO 27001 has controls for keeping information secure and available through a disruption, and auditors ask to see the plan tested. We write it with recovery objectives agreed with the business, test it and file each test.
It costs nothing and commits you to nothing. You get a written list of where your IT environment is exposed, and your team can act on it with or without us.
