ISO 27001:2022
Advisory
Establish an information security management system, address gaps and prepare the policies, controls and evidence needed for certification.
View service
A framework is useful only when its requirements become working controls with owners and evidence. Subdux helps organisations define scope, understand gaps, design practical control improvements and prepare evidence for independent review. Advisory work does not guarantee certification, authorisation or compliance.
Advisory
Establish an information security management system, address gaps and prepare the policies, controls and evidence needed for certification.
View serviceAdvisory
Establish an AI management system covering responsibilities, risks and oversight for how your organisation develops or uses AI.
View serviceAdvisory
Compare your current security practices with your target outcomes and build a prioritised plan for improvement.
View serviceAdvisory
Review personal data handling and help implement the processes, safeguards and records needed to support your GDPR obligations.
View serviceAdvisory
Map personal data flows, assess readiness and help implement processes and safeguards for applicable Indian data protection requirements.
View serviceAdvisory
Assess safeguards for protected health information and help address gaps in access, handling and security practices.
View serviceAdvisory
Prepare controls and supporting evidence for an independent SOC 2 examination, addressing gaps in their design and operation.
View serviceAdvisory
Define the payment data environment, assess control gaps and support remediation ahead of compliance validation.
View serviceAdvisory
Assess the cyber requirements applicable to your regulated entity, address gaps and organise evidence for the relevant audit.
View serviceAssessment
Examine access management, system changes and IT operations to assess whether controls are designed appropriately and working as intended.
View serviceAgree the business objective, scope, dependencies, exclusions and decision owners.
Gather evidence and test the controls, systems or operating practices in scope.
Separate material exposure from background noise and sequence remediation by consequence.
Support implementation, verify progress and leave clear ownership with the operating team.
Begin with the external requirement, customer commitment or internal risk decision driving the work. We confirm the applicable jurisdiction, framework version and assessor expectations with you before any compliance claim is made. Readiness support for US federal programmes such as CMMC and FedRAMP is available on request.
We will recommend the smallest defensible scope, including when a different service — or no engagement — is the better answer.