Talk to Security

GRC & Readiness

Turn compliance obligations into an operating security program.

vCISO, cybersecurity governance, risk management, policy development and readiness implementation across ISO standards, PISF, PTA CTDISR, SOC 2, PCI DSS and other applicable requirements.
Capability

What the engagement is designed to achieve.

The scope is tailored to the environment, but the outcome remains consistent: clear exposure, prioritized action and defensible evidence of what was tested or implemented.
  • Reduce duplicated work by mapping common controls across overlapping frameworks.
  • Create accountable control ownership rather than document-only compliance.
  • Build audit-ready evidence as part of implementation, not as a last-minute exercise.
  • Give leadership a roadmap that connects compliance effort to material cyber risk.

01

vCISO as a Service

Security leadership, governance cadence, roadmap, management reporting, risk oversight and program direction without requiring a full-time CISO.

02

ISO Implementation & Readiness

Implementation support for ISO/IEC 27001, 27701, 42001, ISO 22301 and related cloud security standards.

03

PISF 2026 Readiness

Gap assessment, implementation roadmap, policies, controls, evidence preparation and audit-readiness support for applicable organizations.

04

PTA CTDISR Readiness

Control-by-control readiness, remediation, evidence and implementation support for PTA licensees subject to CTDISR and telecom cybersecurity requirements.

05

SOC 2 & PCI DSS Readiness

Control design, documentation, evidence preparation, remediation and pre-assessment support before independent attestation or validation.

06

Risk, Policy & GRC Program

Risk assessment, policy suite, third-party risk, control mapping, maturity roadmaps, KPIs/KRIs and multi-framework compliance management.
Deliverables

Work products your technical and management teams can use.

Reports and evidence are structured for remediation, ownership and follow-through not only for a closing meeting.

ISO/IEC 27001
PISF 2026
PTA CTDISR
NIST CSF 2.0
SOC 2
PCI DSS 4.0.1
CIS Controls
ISO/IEC 27701
ISO/IEC 42001
COBIT
01

Gap & risk baseline

Defined scope, current-state assessment, material risks and control gaps.

02

Implementation roadmap

Prioritized workstreams, control owners, dependencies, evidence and target milestones.

Governance & documentation

Policies, procedures, registers, statements, plans and management records required by the engagement.

03

Readiness review

Pre-assessment validation of implementation status, evidence quality and open corrective actions.

04
Delivery model

A disciplined path from scope to closure.

01

Triage

Confirm severity, systems, business impact and immediate safety actions.

→
02

Preserve

Secure available evidence and establish collection priorities.

→
03

Contain

Limit attacker access and stop further damage while maintaining critical operations.

→
04

Investigate

Establish timeline, attack path, scope and root cause.

→
05

Recover

Support restoration and convert lessons learned into control improvements.

Frequently asked

Common engagement questions.

Do you issue ISO certificates or SOC 2 reports?
No. Acrotyx provides implementation and readiness support. Certification and formal attestation must be performed by the appropriately accredited or qualified independent assurance provider.
Yes. Multi-framework mapping is often more efficient because many governance and technical controls can satisfy overlapping requirements when designed correctly.
Yes. vCISO can provide the governance layer for an implementation program, including risk ownership, roadmap management, executive reporting and ongoing improvement.

Start with the problem

Turn security findings into measurable risk reduction.

Tell us what you are trying to secure, improve or prepare for. We will help you shape an engagement around your environment, timelines and assurance requirements.

Talk to a security specialist
View our services