Secure the business. Focus on growth.
Stravaya takes on the security and compliance work that growing organisations are asked to carry: senior advisory, and the products we build in Stravaya Labs. Leadership teams stay focused on running and growing the business.
| Requirement | Raised by | How we respond | What you receive |
|---|---|---|---|
| ISO 27001 certification | Customers, tenders | Readiness SprintAssureDesk | A management system ready for audit, with its evidence in one workspace |
| Several frameworks at once | Customers, regulators | ControlRegistryAssureDesk | The work done once on common controls, each framework's requirements judged on their own |
| Security due-diligence questionnaires | Customers, partners | vCISO Essentials | Responses prepared by a senior practitioner, grounded in your evidence |
| India's DPDP Act, or the data protection law that applies to you | Regulators, customers | Data Protection Readiness | Your obligations mapped, owned and evidenced |
| The CERT-In Directions: incidents reported within six hours, logs kept for 180 days | Regulators | Incident Readiness | Reporting and log keeping in place before an incident |
| Board oversight of cyber risk | Board, investors | vCISO Essentials | One view of posture and risk, in terms the board can act on |
Advisory and products, built to work together
Engage our advisory, use our products, or both. The products stand on their own; the advisory uses them.
Senior security and technology leadership
Accountable to your board, and scoped to what a review of your posture finds.
- vCISO Essentials
- vCIO Strategy
- ISO 27001 Readiness Sprint
- Data Protection Readiness
- Incident Readiness
The products we build
One library of controls, read once, serving many frameworks
From the ControlRegistry library, release 1.4.0. Read from the published release when the site is built.
The same five steps, every time
Nothing is proposed until we both know it is the right work, and nothing starts until the scope is agreed in writing.
Every statement to a client, a board or an auditor rests on evidence.
Advice from people who have run enterprise governance, risk and compliance programmes.
The scope follows what the review finds, not a fixed package.
Your acceptance and your auditor's conclusion stay separate. Conflicts are disclosed.
Pro bono advisory for non-profit organisations
Non-profit organisations handle sensitive data and face the same threats as any business, usually with fewer resources. Registered non-profits can access our advisory at no fee. Tell us about your organisation and what you need, and we will confirm eligibility and scope with you.
- A readiness conversation with a senior practitioner
- A review of your security and data protection posture
- A prioritised plan your team can put into practice