ISO 27001 and SOC 2 readiness
Scope, risk assessment, Statement of Applicability, controls and evidence prepared for your certification body or CPA firm.
Security Compliance & Audit Readiness
Pass the audit, and keep the controls working after it.
We prepare you for ISO 27001, SOC 2, PCI DSS and other audits, and for the security rules that regulators in India and abroad set. We find the gaps, write policies people can follow, put controls in place and organise the evidence, then help you stay compliant between audits.
The problem
Why compliance so often turns into busywork.
01
Policies written for the auditor
Documents copied from a template describe a company that does not exist, and staff have never read them.
02
Evidence collected in a panic
Every audit means weeks of screenshots, spreadsheets and late nights, because nothing was collected along the way.
03
Several frameworks, repeated work
ISO 27001, SOC 2, customer questionnaires and regulator rules overlap heavily, but each is handled as a separate project.
04
Regulations that keep changing
New rules from RBI, SEBI, CERT-In and data protection laws arrive faster than most teams can track them.
What we deliver
Compliance that reflects how you really work.
One set of controls mapped to every framework you need, so each new audit builds on the last.
PCI DSS, HIPAA and GDPR
Readiness for card data, health data and EU personal data requirements, including scope reduction and data flow mapping.
India's DPDP Act
A practical programme for India's Digital Personal Data Protection Act: data mapping, consent, notices, rights requests and breach handling.
RBI, SEBI and CERT-In requirements
Gap assessments against RBI cybersecurity and IT governance directions, SEBI CSCRF and CERT-In incident reporting and log retention rules.
Gap assessments and policies
A clear view of where you stand against each framework, and policies and procedures written for how your teams actually work.
Evidence and audit support
Evidence collected continuously, auditor requests managed for you and findings closed quickly after the audit.
How we deliver
From gap assessment to audit, and beyond.
We build the controls first, so the audit becomes a check of work already done.
Always included
- A named senior lead who stays with you from scoping to retest
- Every finding ranked by risk, with clear fix guidance and a retest once you have fixed it
- Reports, configurations and runbooks documented and owned by you
- A founder reviewing the work every week, and an NDA signed before we touch anything
Typical tools
01
Weeks 1 to 3
Gap assessment
We compare what you do today with what each framework or regulation asks for.
- Scope agreed: systems, teams, locations and data
- Interviews and review of existing controls
- Prioritised gap report with effort for each item
02
Weeks 3 to 6
Design controls and policies
One control set that maps to every framework you need.
- Risk assessment and treatment plan
- Policies and procedures written with your teams
- Control owners named and agreed
03
Weeks 6 onward
Implement and collect evidence
Controls put in place and evidence gathered as work happens.
- Technical controls set up with your engineers
- Evidence collection automated where possible
- Internal readiness review before the audit
04
Ongoing
Audit and stay compliant
We support you through the audit and keep things current afterwards.
- Auditor requests managed alongside your team
- Findings closed and evidence refreshed
- Regulatory changes tracked and acted on
Where we apply it
Industries we know well.
FAQ
Questions we hear a lot.
Are you a certification body or licensed auditor?
No. Sunday Labs is not a certification body, a CPA firm, a PCI Qualified Security Assessor or a licensed auditor, and we do not issue certificates or audit opinions. We prepare you for the audit, help you put controls in place and support you while your independent, accredited auditor does the assessment. Keeping the two roles separate is what keeps the audit credible.
Which frameworks and regulations do you cover?
ISO 27001, SOC 2, PCI DSS, HIPAA and GDPR internationally. In India, the Digital Personal Data Protection Act, RBI cybersecurity and IT governance directions for regulated entities, SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) and CERT-In's directions on incident reporting and log retention. We map them to one control set, so overlapping requirements are handled once.
How long does it take to get ready for ISO 27001 or SOC 2?
It depends on your size, scope and how much is already in place. A gap assessment in the first few weeks gives you a realistic plan. For SOC 2 Type II, remember that the auditor also needs to see controls operating over an observation period, so plan for that time on top of readiness work.
What do CERT-In's rules mean for us?
If you operate in India, CERT-In's 2022 directions require certain cybersecurity incidents to be reported within six hours of noticing them and ICT system logs to be kept for 180 days within India. We check whether your logging, retention and incident process meet these rules, and build the reporting steps into your incident response plan.
Can you help us answer customer security questionnaires?
Yes. Once your controls and evidence are organised, answering questionnaires becomes much faster. We can help prepare a standard set of answers and a trust pack your sales team can share.
Do you use a compliance automation platform?
We work with platforms such as Vanta, Drata or Sprinto if you have one or want one, and we can work without one too. A platform helps collect evidence, but it does not replace well-designed controls and people who follow them.
Cybersecurity services
Security across the whole estate.
Cybersecurity Services
Testing, cloud, application, compliance, operations and AI security from one senior team.
Security Assessment & Penetration Testing
VAPT for apps, APIs, cloud and networks, with findings ranked by risk and retested.
Cloud & Infrastructure Security
Posture, identity, Kubernetes and network security for AWS, Azure and GCP.
Application Security & DevSecOps
Security checks built into your pipeline, plus secure code review and training.
Security Operations & Incident Response
24x7 monitoring, SIEM and SOC, vulnerability management and incident response.
AI Security & LLM Risk
Red teaming, guardrails and controls for copilots, RAG systems and AI agents.
Managed Services
Cloud, DevOps, QA and release management, run 24x7 against clear SLAs.
Talk to a founder about Security Compliance.
Tell us where you are. We will come back within one business day with a point of view, not a sales deck.