Data centres & cloud providers

Applicable regulations

• ISO 27001 ISMS; ISO 22301 business continuity
• SOC 2 for service assurance
• DPDP Act 2023 and data-localisation for hosted data
• Customer audit & security-questionnaire requirements

Common cyber risks

• Multi-tenant isolation and shared-infrastructure risk
• Physical-access and environmental control failures
• Availability/uptime commitments under threat (DDoS, power)
• Customer-data localisation and audit-support gaps

Audit findings we typically see

• Isolation controls not independently evidenced
• BCP/DR not tested to RPO/RTO commitments
• Physical-access logs incomplete
• No reusable customer-audit evidence pack

Services required

• ISO 27001 ISMS
• ISO 22301 business continuity
• SOC 2 readiness
• Security architecture review
• VAPT

Our engagement approach

• Scope. Map physical, logical and multi-tenant boundaries and customer commitments.
• Assess. ISO/SOC 2 gap testing, BCP/DR review and isolation testing.
• Remediate. Control design and evidence for uptime, isolation and audit-support.
• Assure. Certification/attestation and reusable customer-audit pack.

Expected evidence

• Physical & logical control evidence
• BCP/DR test results vs RPO/RTO
• Isolation-testing results
• Customer-audit evidence pack

Deliverables

• ISO 27001 / ISO 22301 evidence
• SOC 2 readiness
• Isolation & DR test reports
• Customer-audit support pack