Industries : Built for the firms that feel the pressure first.
Regulated, data-heavy, mid-market — the firms that cannot staff a full security team and cannot afford to fail an assessment. The regulation differs by sector. The seat, and the control program under it, do not.
Defense Supply Chain Manufacturing
Machine shops, fabricators, electronics and precision manufacturers holding DoD contracts or supplying a prime. DFARS 252.204-7012 and CMMC Level 2 are being written into contracts now; the prime wants your SPRS score, your SSP, and a date. Add OT/IT convergence — production systems sharing a network with the office — and the CUI boundary is rarely where anyone assumes.
Healthcare & Health-Tech
Sensitive personal data, AI moving into clinical and administrative workflows, and the HIPAA Security Rule as data-security scope. Increasingly, an enterprise buyer asking for ISO 27001 or SOC 2 as well.
SaaS & AI Product Companies
EU AI Act exposure as a provider or deployer, ISO 42001 appearing in enterprise procurement, and SOC 2 or ISO 27001 expected by every enterprise customer. One control program covers all three.
Retail, E-commerce & Payments
Cardholder data in scope for PCI DSS v4.0.1, customer personal data under GDPR, and AI-driven personalisation that now carries governance obligations. Scope reduction is the first and most valuable move.
Legal & Professional Services
Confidential data at scale, AI tooling inside the workflow, and clients who increasingly demand proof of both — often as a condition of the engagement letter.
HR-Tech & Staffing Platforms
AI in hiring and evaluation is a high-risk category under the EU AI Act, on top of heavy personal-data processing. Provider-versus-deployer mapping decides most of the obligation set.
Financial Services
Data-sensitive, heavily regulated, and first in line for AI-governance scrutiny. In the US that means SOC 2, ISO 27001, and PCI DSS for the payments edge; in India it means RBI, SEBI, IRDAI, and the DPDP Act, delivered from our India branch.
Frequently asked questions
We are a small manufacturer with one DoD subcontract. Does CMMC really apply to us? +
If the contract carries DFARS 252.204-7012 or you handle Controlled Unclassified Information for a prime, yes — and the prime will ask before the DoD does. The good news for a small manufacturer is scope: a narrow, well-defined CUI enclave is far cheaper to bring to Level 2 than the whole company. Scoping is the first thing a readiness review does.
We are a SaaS company selling into enterprises — what do we need? +
Typically ISO 27001 or SOC 2 readiness to clear enterprise procurement, plus EU AI Act and ISO 42001 mapping if your product uses or provides AI features. We crosswalk one control program across all of it — your ISO 27001 controls cover the AI Act’s logging, transparency, and human-oversight requirements at the same time.
We take card payments online. Is PCI DSS a project or a program? +
Under v4.0, a program. Many controls now expect continuous evidence rather than an annual checkbox. The highest-leverage move is reducing scope — tokenisation, a hosted payment page, segmentation — so the program is small. The seat keeps it running between assessments.
We are in manufacturing but not defense — how does this apply to us? +
OT/IT convergence is the entry point: industrial control systems sharing a network with enterprise IT creates attack surface that neither team fully owns. Beyond that, customer questionnaires, cyber-insurance requirements, and AI in production or supply-chain decisions all land on the same control set. We scope to what you actually operate.
We operate in India — do you cover Indian regulators? +
Yes, from our India branch and under the same seat: DPDP Act readiness and an India-resident DPO of record, RBI IS Audit readiness for banks and UCBs, CERT-In empanelled audit preparation, and the RBI governance and BCP documentation set. The India page (DPDP, DPO & RBI) has the full scope.