Bloomwiz Security · GRC
Governance, Risk and Compliance (GRC) services
Compliance, run as a project with an end date. Certification, regulatory readiness, privacy, AI governance and control assurance, for companies who need the certificate to win business and who do not want a consulting engagement that never finishes.
- ISO/IEC 27001, 27701 and 42001
- SOC 2 Type I and II, PCI DSS
- DPDP, GDPR, PDPL, RBI, SEBI, MAS TRM
- Lead Auditor qualified team
Why companies come to us
Compliance work starts with a commercial reason
Almost never because they want a management system. Usually because:
- A customer will not sign without ISO 27001 or SOC 2.
- An investor or acquirer has asked during diligence.
- A regulator or a data protection law now applies to them.
- A questionnaire arrived and nobody could answer it.
- Something was deployed, usually AI, and the board has asked who is assuring it.
The driver is commercial. We treat it that way, and work backwards from the date you need it by.
Certification
Certification and attestation
Gap assessment, the documentation set, control implementation, internal audit, and support through the external audit. We coordinate the certification and attestation bodies inside the scope rather than leaving you to manage them.
| Standard | What we do |
|---|---|
| ISO/IEC 27001 | Information security management system, from gap assessment through certification audit. |
| ISO/IEC 27701 | Privacy information management, as an extension of 27001 or on its own. |
| ISO/IEC 42001 | AI management system. The standard customers have started asking about and very few firms of our size can support. |
| SOC 2 Type I and Type II | Readiness, control design, evidence collection and audit support. |
| PCI DSS | Readiness and control implementation for cardholder data environments. |
| Multi entity certification programmes | Several standards across several legal entities and sites, run as one programme with one owner. |
Our team holds Lead Auditor qualifications for ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001.
Regulation
Regulatory and industry assessments
Regulators now land technology specific expectations rather than principles, and someone has to interpret them before anyone can implement them. That interpretation is the work.
| Framework | Where it applies |
|---|---|
| DPDP Act | India. Readiness assessment, data mapping, consent and rights handling, breach notification. |
| UK and EU GDPR | United Kingdom and Europe, and anyone processing their residents’ data. |
| PDPL | Personal data protection law across the GCC markets. |
| RBI and SEBI guidance | Indian financial services and capital markets. |
| MAS TRM | Technology risk management for Singapore regulated entities. |
| NCSA and NCP guidance | Qatar. Maturity assessment and guideline based data governance and security. |
Privacy
Privacy and data protection
- Data discovery and mapping, and records of processing.
- Consent, lawful basis and data subject rights handling.
- Privacy impact and transfer impact assessments.
- Breach notification readiness, tested rather than documented.
- Data governance frameworks, including classification, retention and cross border transfer.
- Third party and processor due diligence.
AI
AI governance and assurance
AI gets deployed ahead of the framework written to assure it. Boards are now asking for assurance over systems no existing control set anticipated.
- ISO/IEC 42001 readiness and certification support.
- AI risk assessment against the NIST AI Risk Management Framework.
- Responsible AI governance: ownership, approval gates, model inventory, human oversight.
- Assurance over AI already in use inside the business, including the tools nobody formally approved.
- Board level reporting on AI risk, in language a board can act on.
This connects directly to our AI security testing. Governance tells you what should be true. Testing tells you whether it is.
Beyond certification
Assurance, maturity, resilience and policy
Technology and control assurance
- SOX and IT general controls, with audit grade evidence rather than a control questionnaire.
- Control design and operating effectiveness testing.
- Access management, change management and operations control reviews.
- Remediation support where testing finds a control that does not work.
Maturity and transformation
A scored baseline, a gap analysis and a roadmap, built to your organisation rather than adapted from a template.
- Cybersecurity maturity assessment against NIST CSF 2.0 and the CIS Critical Security Controls v8.1.
- Governance and control maturity.
- Enterprise and technology risk maturity.
- National and sector framework maturity assessments, including bespoke frameworks where no standard model fits.
- Security strategy and multi year roadmap, costed and sequenced.
Simulation and resilience
A response plan nobody has rehearsed is a document, not a capability.
- Executive tabletop exercises, run at the level that actually makes the decisions.
- Crisis simulation and cyber incident rehearsal.
- Incident response plan development and testing.
- Business continuity and disaster recovery review.
Policy, risk and the day to day
- A security policy set that reflects how you actually operate, mapped to CIS v8.1 and NIST CSF 2.0, rather than a template downloaded and renamed.
- A risk register your leadership can use to make decisions, with treatment plans and owners.
- Third party and vendor risk assessment.
- Customer security questionnaire response, and standing behind the answers when the customer pushes back.
Method
How we run it
- 01
Gap assessment
Where you are against the standard, and what the gap will cost in time and effort.
- 02
Plan
A dated plan to the certification or deadline, with owners.
- 03
Build
Policies, procedures and controls implemented, not just written.
- 04
Evidence
The artefacts an auditor will ask for, collected as you go rather than in a panic.
- 05
Internal audit
Run before the external auditor arrives, so there are no surprises.
- 06
Audit support
We stay with you through the external audit.
Why us
What makes this different
Compliance work usually stops at documentation. Because we also test, we can tell you whether the control you have documented actually works. An access control policy that reads well and fails a penetration test is not a control.
FAQ
Frequently asked questions
How long does ISO 27001 certification take?
It depends on your starting point, scope and the date you need it by. We begin with a gap assessment that shows what the gap will cost in time and effort, then give you a dated plan with owners.
What is the difference between SOC 2 Type I and Type II?
A SOC 2 Type I report assesses whether controls are suitably designed at a point in time. A Type II report also tests whether those controls operated effectively over a period.
What is ISO/IEC 42001?
ISO/IEC 42001 is the international standard for an AI management system. It gives organisations a structured way to govern the AI they develop or use, and customers have started asking for it.
Does the DPDP Act apply to us?
It may, if you process the personal data of individuals in India. We start with a readiness assessment covering data mapping, consent and rights handling and breach notification.
Do you also test the controls you help document?
Yes. Because Bloomwiz Security also does offensive testing, we can tell you whether a documented control actually works.
Talk to us
Not sure where to start?
A thirty minute conversation, no charge, and an honest view of what you actually need first. Most companies need less than they fear and something different from what they expected.