IT/ITES, BPO and Global Capability Centres — cybersecurity and certification

Applicable regulations

• ISO 27001 ISMS
• SOC 2 (Trust Services Criteria)
• Client-contract and RFP security requirements
• Parent-group security standards and policies (GCCs)
• GDPR and DPDP for processed client data

Common cybersecurity risks

• Client-data handling across many engagements
• Access sprawl and offboarding gaps
• Subcontractor and fourth-party exposure
• Cross-border data-transfer exposure
• Inconsistent evidence across client and group audits

Audit findings we typically see

• ISMS scope not aligned to delivery reality
• Incomplete access recertification
• No reusable evidence for repeated client audits
• Data-transfer mechanisms undocumented
• Penetration-test findings without closure

Services required

• ISO 27001 ISMS
• SOC 2 readiness
• GDPR compliance
• DPDP privacy programme
• VAPT
• Secure source-code review

Our engagement approach

• Scope. Define ISMS and SOC 2 scope aligned to delivery and client commitments.
• Build. Policies, access governance and delivery controls, with evidence.
• Test. VAPT and code review with closure evidence.
• Certify. Certification and attestation coordination, plus an RFP evidence pack.

Expected evidence

• ISMS scope and statement of applicability
• Access-governance evidence
• VAPT and code-review reports
• Reusable RFP security pack

Deliverables

• ISO 27001 and SOC 2 evidence
• Access and delivery control set
• VAPT reports
• RFP-ready security evidence