Frequently asked questions
The questions we are asked most often about certification, audits, timelines, cost and what compliance actually requires. If yours is not here, ask us directly.
4.9/5 average client rating · 500+ engagements delivered
Most organisations reach certification in 8 to 14 weeks. A 50-person SaaS company usually completes ISO 27001 or SOC 2 readiness in 8–10 weeks; multi-site manufacturers with several standards in scope typically need 12–20 weeks. We publish the week-by-week plan before the engagement starts.
No — and that is deliberate. Accreditation rules require independence between the consultant and the certification body. Vyapari Solutions prepares you, runs the internal audit and manages the process, while an accredited certification body or licensed CPA firm performs the final audit and issues the certificate.
No. We build one integrated control set and test shared controls once. Organisations combining ISO 27001 with SOC 2, DPDP or GDPR typically save 30–40% versus running the projects separately, and their teams answer each evidence request only once.
A complete management system: scope and applicability statement, policies and procedures, risk assessment and treatment plan, control implementation evidence, internal audit and management review records, corrective action log, and the auditor liaison through to certificate issue.
Yes. We deliver remotely across 20+ countries from our office in India. GDPR, HIPAA, SOC and PCI DSS work is routinely delivered for clients in the EU, UK, US, GCC and APAC.
Fixed fee per engagement, quoted after a free scoping call. The quote states the standards in scope, sites, headcount, number of audit days and every deliverable, so there are no change orders once work begins. Certification body fees are billed separately by that body.
No. SOC 2 results in an attestation report and an auditor’s opinion, not a certificate. Anyone advertising a "SOC 2 certificate" is describing something that does not exist. What you receive is a report you share under NDA, plus an optional SOC 3 summary you can publish freely.
If a specific deal is blocked, Type I gets you a shareable report in roughly 8 weeks and starts the Type II observation window immediately. If your timeline allows 6+ months, going directly to Type II saves one audit fee. We recommend based on your pipeline, not a fixed rule.
It depends on your level. Level 1 merchants (over 6 million card transactions a year) and most service providers need a QSA-signed Report on Compliance. Levels 2–4 usually self-assess with an SAQ, though many acquirers now require QSA involvement anyway. We confirm your obligation with your acquirer before quoting.
At minimum annually, and after any significant change to the application, infrastructure or authentication model. PCI DSS mandates annual plus after significant change; most SaaS companies test each major release and run continuous scanning between tests.
No. We use rate-limited, non-destructive techniques, agree test windows with your team, keep an escalation contact live throughout, and stop immediately on any sign of instability. Denial-of-service testing is only ever performed on explicit written request in an isolated environment.
The Directions list over twenty incident types including targeted scanning, unauthorised access, website defacement, malware and ransomware, identity theft, data breach or leak, attacks on servers and network devices, IoT and critical systems, and incidents affecting digital payment systems. The clock starts when you notice the incident or are notified of it.
Yes, if you process digital personal data in connection with offering goods or services to Data Principals within India. Location of servers is irrelevant; the trigger is who you serve. Foreign companies typically need an India-based grievance contact and, if notified as an SDF, an India-based DPO.
DPDP is consent-centric with a narrow set of legitimate uses, has no separate "sensitive data" category, no statutory DPIA for every fiduciary, and no right to data portability or objection. GDPR is broader. Practically, a mature GDPR programme covers perhaps 70% of DPDP — the remaining work is consent granularity, multilingual notices, children’s data and Board notification.
A DPO is mandatory only for Significant Data Fiduciaries, and must be based in India and answerable to the board. Every other Data Fiduciary must still publish the contact details of a person who can answer questions about processing. We provide DPO-as-a-service for organisations that need the role without a full-time hire.
If you have no establishment in the EU but you target or monitor people there, Article 27 requires a representative in a member state where your data subjects are, unless a narrow exemption applies. The UK GDPR has an equivalent requirement. We provide or arrange this appointment.
When you are a public authority, when your core activities require regular and systematic monitoring of data subjects on a large scale, or when your core activities involve large-scale processing of special category or criminal conviction data. Many companies appoint one voluntarily because customers ask for a named contact.
GDPR has six lawful bases, sensitive data categories, portability and objection rights, mandatory DPIAs and a risk-based breach threshold. DPDP is consent-centric with fewer rights and mandatory notification of all breaches. If you run GDPR well, the DPDP delta is mainly consent granularity, multilingual notices and children’s data.
Eight to fourteen weeks for a single-site organisation. Certification bodies expect to see the system operating with real records, so the constraint is usually the two to three months of evidence needed before a Stage 2 audit, not the documentation work.
Not since the 2015 revision. You need documented information necessary for the effectiveness of the QMS — scope, policy, objectives, and specified records. Many of our clients keep a short manual anyway because customers ask for one, but it is no longer a clause requirement.
Annex A was restructured from 114 controls in 14 domains to 93 controls in four themes, with 11 new controls covering threat intelligence, cloud security, ICT continuity readiness, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding. Clauses 4–10 changed only marginally.
No. You must consider all 93 and justify exclusions in the Statement of Applicability. Exclusions must follow from your risk assessment and scope — excluding secure development when you build software will not survive an auditor.
Look for the accreditation body mark (NABCB, UKAS, ANAB and so on) alongside the certification body logo, then verify the certificate number on that accreditation body’s public register. A logo without a corresponding register entry is a red flag, and we run this check for clients free of charge.
Not worthless, but frequently not accepted. Government tenders, PSU procurement, exporters and large enterprise supplier programmes almost always specify accredited certification. If you already hold a non-accredited certificate, transitioning usually requires a fresh Stage 1 and Stage 2 audit.
Ask an assessor directly
Most compliance questions have a specific answer that depends on your scope, your sector and who is asking. A short call beats a generic FAQ every time.