Security assurance
Know where your controls actually stand.
Independent assessment of what is implemented, what is documented, and the distance between the two — with a remediation plan you can actually execute.
Readiness and assessment support — not certification
Formal certification against standards such as ISO/IEC 27001 can only be issued by an accredited certification body. We are not one, and we don't imply otherwise. What we provide is the work that comes before and around it: gap analysis, control implementation guidance, documentation support, independent assessment, and internal readiness review before your external audit.
Engagements
Assessment work, matched to the question you're being asked.
A customer security questionnaire, a board risk review and a certification programme need different work. Buying the wrong one wastes a budget cycle.
Cybersecurity Gap Assessment
A structured view of the distance between your current controls and where they need to be.
Covers
- Control coverage against a chosen framework
- Technical and organisational gaps
- Prioritised, costed remediation roadmap
- Quick wins separated from structural work
Security Audit
Independent review of how security is actually implemented and operated — not how it is documented.
Covers
- Technical control verification
- Configuration and hardening review
- Access control and privilege review
- Logging, monitoring and retention review
Cybersecurity Risk Assessment
Risk expressed in terms of business impact and likelihood, so leadership can make funding decisions.
Covers
- Asset and data criticality mapping
- Threat and scenario analysis
- Existing control effectiveness
- Residual risk and treatment options
ISO 27001 Readiness Support
Preparation and assessment support ahead of formal certification by an accredited certification body.
Covers
- Scope definition and gap analysis against ISO/IEC 27001
- ISMS documentation and policy support
- Control implementation guidance
- Internal readiness review before external audit
Security Policy Assessment
Policies that reflect how the organisation actually operates, and are enforceable in practice.
Covers
- Policy set review and gap identification
- Alignment with technical reality
- Practicality and enforceability review
- Drafting and revision support
Vulnerability Assessment
Broad, repeatable identification and prioritisation of known weaknesses across your estate.
Covers
- Authenticated and unauthenticated scanning
- Validation to remove false positives
- Risk-based prioritisation
- Remediation tracking support
Vendor & Third-Party Security Assessment
Your suppliers' security becomes your exposure. Assess it before it becomes your incident.
Covers
- Third-party security questionnaire review
- Evidence validation
- Risk rating and escalation criteria
- Contractual security requirement support
PTA CTDISR Readiness
Preparation for the Critical Telecom Data and Infrastructure Security Regulations that PTA licensees are held to.
Covers
- Gap assessment against CTDISR control areas
- ISMS and incident response capability build-out
- Evidence pack preparation ahead of the formal audit
- Remediation of findings before an approved auditor attends
- Note: the mandatory compliance audit itself must be performed by a PTA-approved auditor
SBP ETGRM & Financial Sector Assessment
Control assessment against State Bank of Pakistan expectations for banks, MFBs, DFIs and payment sector entities.
Covers
- Gap assessment against the ETGRM framework
- Technical verification that documented controls actually operate
- Payment flow and digital channel security review
- Outsourcing and third-party risk assessment
- Board and audit-committee reporting pack
SECP & Sector Requirement Assessment
Assessment support against the security requirements applying to your regulator, your sector and your customers.
Covers
- Applicable requirement mapping (SECP, sector circulars, customer contracts)
- Control gap identification
- Evidence readiness review
- Remediation planning
Pakistan regulatory landscape
The requirements you're actually being held to.
Which apply to you depends on your sector and your customers. For each one: who it covers, what it demands, and precisely what we do about it.
PTA CTDISR
Pakistan Telecommunication Authority (PTA)Critical Telecom Data and Infrastructure Security Regulations, 2020
- Applies to
- PTA licensees — telecom operators, internet service providers and other licensed service providers.
- What it requires
- Requires licensees to implement an information security management system, establish incident response capability, undergo periodic third-party security audits, and meet data localisation and infrastructure protection obligations.
What we do
We perform readiness and gap assessment against CTDISR control areas, help you close the gaps, and prepare your evidence pack. The mandatory compliance audit itself must be carried out by a PTA-approved auditor — we are not one, and we will tell you where to go for it.
SBP ETGRM
State Bank of Pakistan (SBP)Enterprise Technology Governance & Risk Management Framework for Financial Institutions
- Applies to
- Banks, development finance institutions and microfinance banks regulated by SBP.
- What it requires
- Sets expectations for technology governance, information security, risk management, change control, business continuity and outsourcing oversight across regulated financial institutions.
What we do
Control gap assessment against the framework, technical verification that documented controls actually operate, remediation planning, and continuous monitoring for the control areas that require ongoing detection rather than a one-off fix.
SBP Payment Systems
State Bank of Pakistan (SBP)Regulatory expectations for Payment System Operators and Payment Service Providers
- Applies to
- PSOs, PSPs, EMIs and fintech organisations operating under SBP authorisation.
- What it requires
- Security expectations covering transaction integrity, customer data protection, fraud controls, access management and incident reporting for digital payment infrastructure.
What we do
Security assessment of payment flows and supporting infrastructure, application and API penetration testing, and monitoring tuned to fraud-adjacent and account-takeover patterns.
PECA 2016
Federal law — enforced by NCCIAPrevention of Electronic Crimes Act, 2016
- Applies to
- All organisations and individuals in Pakistan.
- What it requires
- Criminalises unauthorised access to information systems and data, among other electronic offences.
What we do
This is why every offensive engagement we run is preceded by written authorisation defining scope, testing windows and out-of-scope systems. Security testing without that authorisation is not a grey area in Pakistan — it is an offence, and we do not perform it.
NCERT
Ministry of IT & TelecommunicationNational Computer Emergency Response Team
- Applies to
- Sectoral CERTs and organisations operating critical information infrastructure.
- What it requires
- National coordination point for cyber incident reporting, advisories and response across sectors.
What we do
We help you build the internal incident response capability and reporting workflow that sectoral obligations assume you already have, and support you through coordination when an incident requires it.
SECP Requirements
Securities & Exchange Commission of Pakistan (SECP)SECP cybersecurity and technology risk expectations
- Applies to
- Non-bank financial companies, insurance companies, brokerages and listed entities.
- What it requires
- Technology governance, cybersecurity and operational resilience expectations for SECP-regulated entities.
What we do
Gap assessment, control testing, policy review and board-level risk reporting suitable for submission to your regulator or audit committee.
Data Protection
Sector regulators; national legislation developingPersonal data protection obligations
- Applies to
- Any organisation processing personal data of individuals in Pakistan.
- What it requires
- Pakistan's dedicated personal data protection legislation is still developing, but SBP and PTA already impose consumer data protection obligations on their regulated sectors, and international customers increasingly impose their own contractually.
What we do
We assess where personal data actually lives in your estate, who can reach it, and whether access is logged — the technical groundwork any data protection regime will require, whichever form the final legislation takes.
ISO/IEC 27001
Accredited certification bodiesISO/IEC 27001 Information Security Management
- Applies to
- Any organisation seeking internationally recognised certification, commonly driven by export customers and enterprise procurement.
- What it requires
- International standard for establishing and operating an information security management system.
What we do
Scope definition, gap analysis, ISMS documentation support, control implementation guidance and internal readiness review before your external audit. Certification itself is issued by an accredited certification body — not by us.
Two limits worth stating plainly, because the industry routinely blurs them. The mandatory PTA CTDISR compliance audit must be carried out by a PTA-approved auditor, and ISO/IEC 27001 certification is issued by an accredited certification body. We are neither. We do the readiness, gap assessment, remediation and evidence work that makes those engagements go smoothly — and we will tell you when you need to appoint someone else.
How an assessment runs
Five phases, with a defined output at each.
You should know at the outset what you will have at the end, and be able to tell whether it arrived.
- 01
Establish scope
What is in scope, which framework or requirement set applies, and what evidence already exists.
- 02
Assess
Technical control verification, configuration review, documentation review and interviews with the people who operate the controls.
- 03
Analyse the gap
Where controls are absent, partially implemented, documented but not operating, or operating but not evidenced.
- 04
Report & prioritise
Findings with business context and a remediation roadmap sequenced by risk reduction and realistic effort.
- 05
Support remediation
Optional delivery support, including implementing monitoring for gaps that need ongoing detection rather than a one-time fix.
Questions
Audits and compliance, answered.
No. The formal CTDISR compliance audit must be performed by a PTA-approved auditor, and we are not on that list. What we do is the work around it: gap assessment against the control areas, building the incident response capability the regulations assume, remediating findings and preparing your evidence pack so the approved auditor's engagement goes smoothly.
No. Certification can only be issued by an accredited certification body. We provide readiness support and assessment: scope definition, gap analysis, ISMS documentation, control implementation guidance, and internal readiness review before your external audit.
Gap assessment against the State Bank's Enterprise Technology Governance & Risk Management framework, technical verification that documented controls actually operate, payment channel security review, outsourcing and third-party risk assessment, and reporting suitable for your board and audit committee.
A gap assessment measures your current controls against a target framework and produces a roadmap to close the difference. An audit independently verifies how controls are actually implemented and operated in practice.
Both. Assessment output is a prioritised remediation plan, and we can support delivery of that plan — including implementing monitoring for the control gaps that require ongoing detection rather than a one-off fix.
Next step
Establish your actual position.
Tell us what's driving the assessment — a customer requirement, a certification target, a board question or a genuine unknown — and we'll scope the work that answers it.
- 1Tell us about your environment
- 2We scope what's actually needed
- 3You get a written assessment plan