Services · Security and GRC
Services
Security testing and compliance work, done as part of your team. Delivered remotely from India, for clients anywhere.
Security
Find what an attacker would find, and close it before an auditor, a regulator or a customer asks.
Security · Service
VAPT and penetration testing
Web, mobile, API, cloud and network testing, with a retest after your fixes.
2 to 4 weeks a test
Security · Service
Application security
Secure code review, threat modelling and security checks built into your release pipeline.
4 to 8 weeks
Security · Service
Red teaming
An adversary simulation against your people, processes and systems, with an assumed-breach option.
4 to 6 weeks
Security · Service
Network and cloud security review
Configuration, segmentation and access reviewed against the CIS Benchmarks for your network and cloud accounts.
2 to 3 weeks
Security · Service
Vulnerability assessment
Scheduled scans, with each finding checked, ranked and tracked until it is closed.
Monthly or quarterly
GRC
Certifications, privacy laws and reporting, from the gap assessment to the audit, and someone to own it after.
GRC · Service
ISO 27001 certification support
From gap assessment to the certification audit, with the Statement of Applicability written with you.
3 to 6 months
GRC · Service
ISO 27701 privacy management
A privacy information management system, on its own or beside your ISO 27001, mapped to DPDP and GDPR.
2 to 4 months
GRC · Service
ISO 42001 AI management system
Policies, impact assessments and the Annex A controls that apply to the AI you build or use.
3 to 6 months
GRC · Service
SOC 2 Type 2 readiness
Scope, controls and evidence ready for your auditor, then support through the observation period.
8 to 12 weeks, then the observation period
GRC · Service
DPDP readiness and implementation
Data mapping, notices, consent, breach response and rights handling in place before 13 May 2027.
6 to 12 weeks
GRC · Service
GDPR and CCPA compliance
Records, notices, contracts and rights handling for selling into the EU and California.
6 to 10 weeks
GRC · Service
EU AI Act compliance
Classify your AI systems by risk, then put the obligations for each tier in place.
6 to 12 weeks
GRC · Service
BRSR and ESG reporting
BRSR and BRSR Core disclosures prepared and ready for assessment or assurance.
8 to 12 weeks
GRC · Service
Fractional DPO and vCISO
A named Data Protection Officer or Chief Information Security Officer for your company, by the month.
Monthly
GRC · Service
Security and privacy training
Role-based training for staff, engineers and boards, with records your auditor can check.
Half a day to two days
How an engagement runs
Step 1
A scoping call
A short call on what you need, by when and what is in scope. You get a written scope and a quote.
Step 2
The work, inside your team
Infofacility's consultants work in your tools and channels, with a named lead and a weekly update.
Step 3
Evidence that holds up
Reports, policies and records your auditor, regulator or customer can rely on, each tied to the clause it answers.
Pricing
All services
Price on request
Scope sets the price. Book a scoping call and get a written quote, in USD or rupees.
Talk to a consultant
Tell Infofacility what you need. A consultant calls you back to scope it.