Security services · Governance

Compliance and GRC, without the paperwork pain.

Enterprise customers ask for ISO 27001 or a SOC 2 report. Regulators ask for evidence. We build the policies, controls and evidence auditors expect, sized for your company, and stay with you through the audit.

Get a fixed-price quote
ISO 27001, SOC 2, PCI DSS, DPDPAudit-ready evidence packsWe prepare you; independent auditors certify
ISO 27001 project · sample● demo
  1. FLAGGED Access review overdue on 3 systems
  2. FIXED Supplier risk register completed
  3. FOUND No record of backup restore tests
  4. PASSED Internal audit: no major findings
  5. PASSED Stage 2 audit passed
In plain words

Compliance and GRC (governance, risk and compliance) work turns good security intentions into written rules, working controls and evidence that auditors, customers and regulators accept. We run a gap assessment, write your policies, set up the risk register and controls, collect evidence, run an internal audit and support you through the external audit for ISO/IEC 27001, SOC 2 and PCI DSS, and India’s DPDP Act.

Audit-ready in
6–16 weeks
Frameworks
ISO 27001 · SOC 2 · PCI DSS · DPDP
Certified by
An independent auditor
Pricing
Fixed fee
The road to a certificate

From gap assessment to certificate.

This is the typical path to ISO/IEC 27001 certification. We do the building with you; an independent certification body does the auditing.

The road to ISO/IEC 27001 certification: gap assessment, risk assessment, policies and controls, evidence, internal audit and management review, which HanulSec helps you build and run; then the Stage 1 and Stage 2 audits by an independent certification body, and a certificate valid for three years. GAPASSESSMENTWhere you standRISKASSESSMENTWhat could go wrongPOLICIES& CONTROLSWritten and workingEVIDENCEControls run for weeksINTERNALAUDITA dress rehearsalMANAGEMENTREVIEWLeaders sign offSTAGE 1AUDITDocuments checkedSTAGE 2AUDITControls testedCERTIFICATEValid for 3 yearsHANULSEC HELPS YOU BUILD AND RUN ITINDEPENDENT CERTIFICATION BODY
Typical path for ISO/IEC 27001:2022. Most small and mid-sized companies are audit-ready in 6 to 16 weeks with our help. SOC 2 follows a similar shape, ending in a CPA firm’s report instead of a certificate.
What we build

Everything the auditor will ask to see.

  • Gap assessment

    Where you stand against the standard, and the shortest route to ready.

  • Risk assessment

    A risk register your team understands and actually updates.

  • Policies and procedures

    Written for how your company works, not copied from a template.

  • Statement of Applicability

    Each of the 93 ISO 27001 Annex A controls: used or not, and why.

  • Control rollout

    Access reviews, backups, logging, change control and supplier checks.

  • Evidence pack

    Organised proof that controls run, ready for the auditor.

  • Internal audit

    An independent rehearsal before the real audit.

  • Supplier risk

    Questionnaires and contracts for the vendors who hold your data.

  • Customer questionnaires

    Help answering long security questionnaires, quickly and consistently.

A common question

ISO 27001 or SOC 2?

Ask your customers. Many controls overlap, so we can build once and map to both.

ISO/IEC 27001

An international certificate for your security management system.

  • Recognised worldwide, and most asked for in India, Europe and the Gulf
  • Certificate valid for three years, with yearly surveillance audits
  • Covers your whole management system and the 93 Annex A controls
  • Less familiar to some US buyers

SOC 2

An auditor’s report on your controls, from a licensed CPA firm.

  • Expected by many US customers
  • A Type II report shows controls working over 3 to 12 months
  • Built on the AICPA Trust Services Criteria
  • A report, not a certificate, usually renewed every year
How it works

Five phases, one fixed fee.

  1. Weeks 1–2

    Gap assessment

    Interviews and document review against the standard, with a scored gap report.

  2. Weeks 2–5

    Policy design

    Policies and procedures written with your team and approved by leaders.

  3. Weeks 4–12

    Control rollout

    Controls switched on and evidence collected as they run.

  4. Weeks 10–14

    Internal audit

    An independent check, so the real audit holds no surprises.

  5. With your auditor

    Certification

    We support you through Stage 1 and Stage 2, or the SOC 2 audit period.

What you get

A system that keeps itself ready.

HANULSECISO 27001 readiness report CLIENTSample · 80-person SaaS company SUMMARY FOR LEADERS FINDINGS BY SEVERITYCritical0High3Medium9Low14 ANNEX A · 93 CONTROLS MAPPED AUDIT READY Sample layout, not client data
  • 01
    Control matrix

    Every control, its owner, how it runs and where its evidence lives.

  • 02
    Policy library

    Short, readable policies your staff can follow.

  • 03
    Risk register

    Risks, owners, treatments and review dates.

  • 04
    Audit-ready evidence pack

    Organised so the auditor finds what they need quickly.

  • 05
    Internal audit report

    Findings and fixes before the external audit.

  • 06
    Audit-day support

    We sit with your team during the auditor’s visits.

Who it is for

When a customer asks for the certificate.

  • SaaS and IT services firms asked for ISO 27001 or SOC 2 by customers
  • Companies answering long security questionnaires every month
  • Payment businesses that handle card data (PCI DSS)
  • Companies preparing for the DPDP Act, which takes full effect on 13 May 2027
  • Firms building AI that want ISO/IEC 42001 as well

An honest note

We prepare you for certification; we do not issue certificates. ISO certificates come from accredited certification bodies and SOC 2 reports from licensed CPA firms, which keeps the result independent.

HanulSec’s own ISO/IEC 27001 and ISO/IEC 42001 certifications are in progress.

Frameworks

Standards we prepare you for.

ISO/IEC 27001Information security
SOC 2Trust Services Criteria
PCI DSS v4.0Card data security
DPDP Act 2023With the DPDP Rules 2025
ISO/IEC 42001AI management systems
NIST CSF 2.0Govern to recover

Emblems are HanulSec’s own artwork showing which frameworks our work maps to. They are not the owners’ logos and do not mean HanulSec is certified against them.

Questions

Questions buyers ask before they call us.

Q01How long does ISO 27001 certification take?
With our help, most small and mid-sized companies are ready for the audit in 6 to 16 weeks. The certification body’s Stage 1 and Stage 2 audits follow, and controls usually need to run for a while first so the auditor can see evidence of them working.
Q02How much does ISO 27001 cost?
Our fee is fixed after a free scoping call. It depends on company size, the number of locations and systems in scope and how much already exists. The certification body charges separately for its audits.
Q03ISO 27001 or SOC 2: which do we need?
Ask your customers. US customers usually ask for a SOC 2 report; customers in India, Europe and the Middle East usually ask for ISO 27001. Many controls overlap, so we can build once and map to both.
Q04What changed in ISO 27001:2022?
The 2022 version reorganised the Annex A controls into 93 controls in four themes (organisational, people, physical and technological) and added new ones such as threat intelligence, cloud services security, data masking and secure coding. Certificates to the 2013 version expired on 31 October 2025.
Q05Can you help with the DPDP Act too?
Yes: data mapping, notices and consent, reasonable security safeguards, breach response and processor contracts. See our DPDP Act guide.
Q06Do you write the policies, or just hand over templates?
We write them for your company, based on how you actually work, so your team can follow them and auditors can test them.
Q07How is it priced?
A fixed fee per framework after a free scoping call, with optional monthly support to keep the system running after certification.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings