Proven SecurityManaged GRC for APAC
Log in Book a readiness call

Managed GRC and security services for small businesses.

Everything you need to earn a certificate, keep it, and run security day to day, delivered by analysts in India and Singapore.

Get compliant

Close the gaps between where you are and what an auditor needs to see.

SOC 2 readiness and audit support

Get a SOC 2 Type I or Type II report your customers will accept, without hiring a compliance lead.

Typical timeline: 10 to 14 weeks to Type IBest for: SaaS and service companies selling to US or enterprise buyers

What we do

  • Scope systems and Trust Services Criteria
  • Run a gap assessment in Proven Assure
  • Remediate controls with your engineers
  • Select and manage an independent CPA firm
  • Handle auditor requests during fieldwork

What you get

  • Gap report and remediation plan
  • Complete, auditor-ready evidence set
  • SOC 2 report from a licensed CPA firm
  • A clear plan for your Type II window

ISO 27001 implementation

Build an information security management system that passes certification and fits a small team.

Typical timeline: 4 to 6 months to certificationBest for: Companies selling into Europe, Japan, Australia or government

What we do

  • Define ISMS scope and context
  • Write the Statement of Applicability
  • Run risk assessment and treatment
  • Conduct the internal audit and management review
  • Support stage 1 and stage 2 audits

What you get

  • A working ISMS in Proven Assure
  • Annex A controls mapped and evidenced
  • Internal audit report
  • Certification from an accredited body

Privacy compliance and DPO-as-a-service

Meet India's Digital Personal Data Protection Act, Singapore's PDPA and GDPR with one privacy programme.

Typical timeline: 6 to 10 weeks for the baselineBest for: Any business handling customer personal data

What we do

  • Map personal data across your systems
  • Draft notices, consent flows and retention rules
  • Set up data subject request handling
  • Act as your Data Protection Officer
  • Run privacy impact assessments

What you get

  • Records of processing
  • Privacy notice and internal policies
  • Breach notification playbook
  • Named DPO contact for regulators

Policies and procedures

A complete policy set written around how your company works, approved and tracked in one place.

Typical timeline: 2 to 3 weeksBest for: Teams starting their first compliance programme

What we do

  • Interview owners across engineering, HR and finance
  • Write policies to SOC 2, ISO 27001 and local law
  • Set review cycles and approvers
  • Collect staff acknowledgements

What you get

  • 25+ tailored policies
  • Version history and sign-off records
  • Staff acknowledgement tracking

Stay compliant

Keep controls working all year, so the next audit is a formality.

Virtual CISO

A named, senior security leader for a fraction of the cost of a full-time hire.

Commitment: From 2 days a monthBest for: Founders and CTOs fielding board and customer security questions

What we do

  • Own your security roadmap and budget
  • Join customer and investor security calls
  • Report to your board each quarter
  • Approve risk acceptances and exceptions

What you get

  • Quarterly board security report
  • 12-month security roadmap
  • A single accountable security lead

Risk assessments and risk register

Know your top risks, who owns them and what is being done, in language your leadership understands.

Cadence: Annual, plus on significant changeFrameworks: ISO 27005, NIST CSF

What we do

  • Facilitate risk workshops with leadership
  • Score likelihood and impact consistently
  • Agree treatments, owners and deadlines
  • Track progress in Proven Assure

What you get

  • Live risk register
  • Risk treatment plan
  • Summary for the board

Vendor risk management

Assess the suppliers who hold your data, and keep their certificates and contracts from expiring unnoticed.

Cadence: At onboarding and annuallyBest for: Companies with 15 or more SaaS vendors

What we do

  • Tier vendors by data and business impact
  • Send and review security questionnaires
  • Check SOC 2 reports and ISO certificates
  • Track contract and DPA terms

What you get

  • Vendor inventory with risk tiers
  • Review records for auditors
  • Expiry alerts for certificates

Security questionnaires and trust centre

Stop losing deals to 300-question security reviews. We answer them and keep your public trust centre current.

Turnaround: 3 working days for most questionnairesFormats: SIG, CAIQ, custom spreadsheets and portals

What we do

  • Build an approved answer library
  • Complete customer questionnaires
  • Join security review calls with buyers
  • Publish reports and policies under NDA

What you get

  • Faster security reviews
  • Consistent, accurate answers
  • A trust centre page for prospects

Run security day to day

The managed services your controls depend on, operated by our team.

Managed SOC and MDR

Round-the-clock monitoring of your endpoints, cloud and identity, with analysts who respond when something is wrong.

Coverage: 24/7, 365 daysResponse: Containment within agreed SLAs

What we do

  • Deploy and tune endpoint detection
  • Monitor cloud, email and identity logs
  • Investigate and triage alerts
  • Contain threats and guide recovery

What you get

  • Monthly threat report
  • Incident records for auditors
  • Evidence for SOC 2 CC7 controls

Vulnerability management

Continuous scanning of your servers, cloud and applications, with fixes ranked by real risk, not raw counts.

Cadence: Continuous scanning, monthly reviewScope: External, internal, cloud and container images

What we do

  • Run authenticated vulnerability scans
  • Prioritise by exploitability and exposure
  • Raise and track fix tickets
  • Verify remediation

What you get

  • Prioritised fix list
  • Patch SLA reporting
  • Scan history for auditors

Cloud security posture management

Find and fix risky configuration in AWS, Azure and Google Cloud before an auditor or attacker does.

Benchmarks: CIS, SOC 2, ISO 27001Clouds: AWS, Azure, Google Cloud

What we do

  • Connect read-only to your cloud accounts
  • Monitor configuration against benchmarks
  • Alert on new drift
  • Help engineers fix issues safely

What you get

  • Posture score per account
  • Drift alerts
  • Configuration evidence collected automatically

Security awareness training and phishing simulation

Short, practical training in English, Hindi, Bahasa and more, with completion records ready for audit.

Cadence: Onboarding, annual and monthly micro-lessonsLanguages: 8 APAC languages

What we do

  • Assign training by role
  • Run monthly phishing simulations
  • Follow up with people who click
  • Report completion to leadership

What you get

  • Completion records per person
  • Phishing trend reporting
  • Evidence for SOC 2 CC1 and CC2

Incident response and business continuity

Be ready for the bad day: written plans, practised teams, and someone to call.

Includes: Annual tabletop exerciseRetainer: Optional on-call incident support

What we do

  • Write incident response and BCP plans
  • Run tabletop exercises with leadership
  • Test backups and recovery
  • Lead response during real incidents

What you get

  • Tested IR and BCP plans
  • Exercise reports
  • Regulator notification support, including CERT-In
We don't perform penetration testing. When your audit needs one, we scope it, introduce an independent testing firm and track every finding through to closure.

Questions we hear often

Can't find your answer? Ask an analyst.

Do we need SOC 2 or ISO 27001?

If most of your customers are in the US, SOC 2 is usually what they ask for. If you sell into Europe, Japan, Australia or government, ISO 27001 is more common. Many of our customers do both, and because Proven Assure maps controls once, the second framework takes much less work.

Are you the auditor?

No. An auditor has to be independent of the team that prepares you. We introduce licensed CPA firms for SOC 2 and accredited certification bodies for ISO 27001, and we manage the audit on your behalf.

How much of our team's time will this take?

Usually two to four hours a week from an engineering lead during remediation, and less from everyone else. Our analysts do the writing, evidence collection and audit coordination.

Can you work with our existing security tools?

Yes. Our managed SOC and vulnerability services work with leading endpoint and cloud tools, and Proven Assure integrates with the systems most small businesses already use.

Why don't you do penetration testing?

We focus on governance, compliance and managed security operations. Auditors and customers trust a penetration test more when it comes from an independent specialist, so we partner with testing firms and manage the findings for you.

Find out how close you are to SOC 2.

A 30-minute call with an analyst. You leave with a gap list, a timeline and a price.

Book a readiness call