Cyber security consultancy in Kolkata

We begin by mapping what would genuinely hurt: which systems, which data, which processes, and what an hour or a day of unavailability costs you. Controls chosen without that context tend to protect the wrong things thoroughly.

From there we assess the current state across identity, endpoints, network, applications, cloud, backup and supplier arrangements, and record findings with evidence rather than impressions.

The output is a risk register in your language, with likelihood, impact, existing controls and a recommended treatment, plus an owner and a target date for each item. A register nobody owns is a document, not a control.

The Digital Personal Data Protection Act 2023 became operational through the DPDP Rules notified in November 2025, which phase in obligations over the following months, with the substantive business requirements around consent, notice, retention, erasure and security safeguards arriving on the longer timeline.

Practical readiness starts with a data map: what personal data you hold, where it lives, why you hold it, who you share it with and how long you keep it. Most organisations discover copies they had forgotten, and deleting those is often the cheapest risk reduction available.

We then work through consent notices in clear language, withdrawal and grievance mechanisms, retention and erasure rules, processor contracts, and a breach notification runbook covering both the individuals affected and the Data Protection Board.

For ISO 27001:2022 we run a gap assessment against the management system clauses and the ninety-three Annex A controls, help you define scope and the statement of applicability, build the documentation set, and prepare you for stage one and stage two audits with the certification body.

For regulated sectors we map the same underlying controls onto the applicable framework, whether that is the SEBI cyber security and cyber resilience framework for market intermediaries or the CERT-In directions on logging, clock synchronisation and six-hour incident reporting.

Doing this once and mapping many-to-one avoids the common trap of running three parallel compliance programmes that all ask for the same evidence in different formats.

Many mid-sized Indian firms need security leadership a few days a month rather than a permanent hire. We work as an outside security lead: chairing a monthly review, keeping the risk register current, reviewing architecture changes before they ship and answering customer security questionnaires.

That last item matters commercially. Enterprise buyers now send detailed security due diligence questionnaires, and a slow or weak response delays contracts. Having consistent, evidenced answers on file shortens sales cycles.

We also review supplier and vendor risk, since a large share of incidents arrive through a third party with access to your systems or your data.