Cybersecurity Audit.
We review how well your business is protected against common attacks and data loss, and give you a prioritised plan to fix what we find. The audit covers network and firewall settings, endpoints, cloud and email accounts, ERP access, backups and policies, benchmarked against CERT-In's elemental cyber defence controls for MSMEs, with vulnerability assessment and penetration testing where scoped.
Typically 2–4 weeks from access being granted, plus time for your fixes before the retest. The number of systems, locations and internet-facing applications drive the time.
A partner — a chartered accountant or company secretary — from the first call to sign-off.
Based on your situation, and fixed in writing before any work starts.
Is this for you?
- SMEs that have never had an independent security review
- Businesses responding to security requirements from customers, lenders or insurers
- Companies preparing for the security safeguards required under the DPDP Act
What you receive at the end.
- 01Audit report with risk-rated findings and evidence
- 02Gap assessment against CERT-In's 15 elemental controls for MSMEs
- 03Prioritised remediation plan
- 04CERT-In directions readiness checklist
- 05Retest results after remediation
Cybersecurity Audit, step by step.
Typically 2–4 weeks from access being granted, plus time for your fixes before the retest. The number of systems, locations and internet-facing applications drive the time.
- 1
Scope and authorisation
We agree the systems in scope, testing windows and rules of engagement, and obtain your written authorisation for any testing.
- 2
Information gathering
We review asset lists, network diagrams, policies, user access and backup records.
- 3
Technical testing
Vulnerability scans and, where scoped, penetration tests are run on agreed systems, and firewall, cloud tenant and endpoint configurations are reviewed.
- 4
Compliance check
We check readiness for CERT-In's directions, including 6-hour incident reporting, 180-day log retention within India and clock synchronisation.
- 5
Report and debrief
Findings are rated by risk, with evidence and specific fixes, and presented to management.
- 6
Retest after fixes
After you fix the issues, we retest them and update the report.
What we need from you.
Don't have everything yet? We send a short checklist after the first call and work with what you have.
- Inventory of hardware, software, cloud services and internet-facing systems
- Network diagram and firewall or router access
- Admin or read-only access to Microsoft 365 or Google Workspace and key servers
- IT and security policies, where they exist
- Backup and incident records
- Written authorisation for scanning and testing, and a technical contact
The fee depends on your situation. After a short call, the partner who will do the work tells you what's involved and gives you a fixed fee in writing — before any work begins.
- Government fees and statutory charges are billed at actuals.
- When you pay — upfront, in stages or on completion — is agreed in writing with the fee.
Questions about Cybersecurity Audit.
Ready to discuss Cybersecurity Audit?
30-minute confidential call — no proposal, no commitment. A partner will write back within one business day.