Skip to main content
Subdux

Governance, Risk & Compliance: Make assurance part of the operating model.

A framework is useful only when its requirements become working controls with owners and evidence. Subdux helps organisations define scope, understand gaps, design practical control improvements and prepare evidence for independent review. Advisory work does not guarantee certification, authorisation or compliance.

Capabilities and outcomes

Security & AI Governance

ISO 27001:2022

Advisory

Establish an information security management system, address gaps and prepare the policies, controls and evidence needed for certification.

View service

ISO 42001

Advisory

Establish an AI management system covering responsibilities, risks and oversight for how your organisation develops or uses AI.

View service

NIST CSF

Advisory

Compare your current security practices with your target outcomes and build a prioritised plan for improvement.

View service

Privacy & Data Protection

GDPR

Advisory

Review personal data handling and help implement the processes, safeguards and records needed to support your GDPR obligations.

View service

DPDP Act

Advisory

Map personal data flows, assess readiness and help implement processes and safeguards for applicable Indian data protection requirements.

View service

HIPAA

Advisory

Assess safeguards for protected health information and help address gaps in access, handling and security practices.

View service

Audit & Assurance

SOC 2 Readiness

Advisory

Prepare controls and supporting evidence for an independent SOC 2 examination, addressing gaps in their design and operation.

View service

PCI DSS Readiness

Advisory

Define the payment data environment, assess control gaps and support remediation ahead of compliance validation.

View service

SEBI / RBI / IRDAI Audit Readiness

Advisory

Assess the cyber requirements applicable to your regulated entity, address gaps and organise evidence for the relevant audit.

View service

IT General Controls Audit

Assessment

Examine access management, system changes and IT operations to assess whether controls are designed appropriately and working as intended.

View service
Delivery model

Scope before tooling. Evidence before opinion.

  1. Define

    Agree the business objective, scope, dependencies, exclusions and decision owners.

  2. Assess

    Gather evidence and test the controls, systems or operating practices in scope.

  3. Prioritise

    Separate material exposure from background noise and sequence remediation by consequence.

  4. Improve

    Support implementation, verify progress and leave clear ownership with the operating team.

Choosing a starting point

Start with the decision you need to make.

Begin with the external requirement, customer commitment or internal risk decision driving the work. We confirm the applicable jurisdiction, framework version and assessor expectations with you before any compliance claim is made. Readiness support for US federal programmes such as CMMC and FedRAMP is available on request.

We will recommend the smallest defensible scope, including when a different service — or no engagement — is the better answer.

Discuss your requirements