Skip to main content
Threatsys One AI

Compliance guides

Plain-English guides to the frameworks that matter

Practical walkthroughs of ISO 27001, PCI DSS, SOC 2, DPDP and VAPT, written by the CERT-In empanelled senior auditors who run these assessments. What the standard actually asks for, what evidence satisfies it, and where teams usually fail.

01 / 07

ISO 27001

The global standard for information security management, the certification enterprise buyers ask for most.

ISO 27001 certification process and timeline (India)

What actually happens between a gap assessment and a certificate, who is involved at each stage, and which parts genuinely cannot be compressed.

  • Process
  • Timeline

SOC 2 or ISO 27001, which do you need?

The two get demanded interchangeably by buyers. This sets out what each one proves, what it costs, and when holding both is worth it.

  • Comparison

Check your ISO 27001 readiness in five questions

Scope, risk, policies, operations and internal audit. Answer five questions and see where a certification auditor would push back.

  • Free tool
  • 1 minute

Score all 93 Annex A controls

The long version. Twenty-two control questions across six domains, producing a banded readiness score and a ranked gap list.

  • Free tool
  • 15 minutes
ISO 27001 with GRC 360

02 / 07

PCI DSS

Payment card data security, mandatory for anyone who stores, processes or transmits cardholder data.

PCI DSS 4.0: what changed and what to do

The future-dated requirements that are now mandatory, the customised approach explained, and what a QSA will look for first.

  • v4.0.1

Am I even in scope? Check in four questions

How card data flows through your business decides everything else. This returns your likely SAQ type or merchant level and the validation path.

  • Free tool
  • 1 minute

What a PCI DSS engagement costs

Scope, size, infrastructure and current readiness drive the number. See an indicative range and timeline before you talk to anyone.

  • Free tool
PCI DSS assessment

03 / 07

SOC 2

The trust report US and global customers expect from SaaS vendors before they buy.

SOC 2 audit cost and timeline (India)

What drives the price, how long each phase takes, and where organisations quietly lose months.

  • Cost
  • Timeline

Type I or Type II, and how long a window

Which one your buyer actually wants, and how long the observation window needs to be to satisfy them.

  • Report type

Choosing Trust Services Criteria

Adding criteria you cannot evidence costs more than it wins in the sales cycle. Here is how to pick.

  • Scoping
SOC 2 readiness

04 / 07

VAPT / Penetration Testing

Find and fix real vulnerabilities before attackers do, with CERT-In empanelled, senior-auditor-led testing.

How to choose a VAPT provider in India

The questions that separate a genuine testing practice from a vendor who forwards you a scanner report.

  • Selection

CERT-In empanelled vs non-empanelled auditors

When empanelment is a legal requirement rather than a preference, and what it actually guarantees.

  • CERT-In

Price your pentest scope yourself

Thirteen test types across web, API, mobile, infrastructure, code review, cloud, LLM and IoT. Add quantities and watch the estimate update.

  • Free tool
AppSec 360

05 / 07

DPDP and Data Privacy

India’s Digital Personal Data Protection Act, and the board-level accountability it creates for how you handle personal data.

DPDP Act compliance checklist (2026)

Ninety-three controls across a universal baseline and nine sector overlays, plus a six phase roadmap. Work through it as a live checklist.

  • Free tool
  • Interactive

How ready are you? Five questions

Consent, rights, breach response and data mapping. Returns a readiness verdict with your priority gaps ranked.

  • Free tool
  • 1 minute

What could this cost you?

Map your gaps against the penalty Schedule to the Act and see the maximum exposure, up to Rs 250 crore.

  • Free tool

DPDP and GDPR together

Where one control set serves both, and the handful of places it genuinely cannot.

  • Cross-mapping
DPDP 360

06 / 07

Regulatory and Strategy

Sector rules, and the build against buy decisions behind a compliance programme that actually holds up.

RBI cyber security framework for NBFCs

Which controls apply at your entity size, what the IT examination looks at, and the reporting cadence.

  • RBI

Continuous compliance vs annual audits

Why evidence collected once a year is the most expensive way to stay compliant.

  • Operating model

Compliance automation vs expert consulting

What tooling genuinely automates, what it cannot, and where an assessor is still required.

  • Tooling

One control set, many frameworks

How to collect evidence once and have it satisfy PCI DSS, ISO 27001, SOC 2 and DPDP together.

  • Cross-mapping
Continuous compliance

07 / 07

Not sure where to start?

Begin with a score rather than a proposal.

Take the free guided assessment

Eight questions, no contact details needed. You get a readiness score, your top three gaps, an indicative cost and a timeline.

  • Free
  • 2 minutes
See all free tools

More resources

Keep going

Handbooks

All six product handbooks, plus published case studies.

Open

Knowledge Center

All 122 standards we audit against, searchable, each with its own guide.

Open

Free Self Assessment

Answer a short control survey, get an instant readiness score.

Open

DPDPA Compliance Hub

Lifecycle and industry control sets for the DPDP Act, 2023.

Open

Free Tools and Calculators

Nine interactive tools for cost, scope, penalty and readiness.

Open

Talk to us

Want the guide applied to your environment?

A senior assessor will walk your scope, tell you which of these apply and what the realistic path to an audit looks like.

Talk to an assessor+91 9668200222
support@threatsys.co.in