Security and GRC work that stands up to an audit
Our cybersecurity and GRC services cover penetration testing, ISO 27001 and SOC 2 readiness, AI governance and security training. Every engagement ends with evidence you can hand to an auditor, a regulator or your board.
Timelines, deliverables and frameworks
How long each engagement takes, and what you get
Every engagement is scoped and quoted after a free 30-minute discovery call, with a written proposal within two working days. Cost depends on the size of the environment, the number of applications and users in scope, and the framework you are working towards.
| Engagement | Timeline | Deliverable |
|---|---|---|
| Penetration test | 2 to 3 weeks | Findings report, remediation plan |
| ISO 27001 readiness | 8 to 12 weeks | Gap report, ISMS pack, audit prep |
| SOC 2 Type 1 readiness | 6 to 10 weeks | Control mapping, evidence pack |
| vCISO retainer | Rolling, monthly | Strategy, board reporting, oversight |
| Phishing simulation | 2 to 4 weeks | Campaign report, training plan |
| Security training | 1 to 2 days | Workshop, attestations, materials |
| AI governance / GRC engagement | 2 to 6 weeks of scoping | Risk and control assessment, governance roadmap |
Frameworks we work across
Tools and platforms in our stack
Detection and response
Wazuh, CrowdStrike, Microsoft Defender, Elastic Security.
Offensive security
Burp Suite, OWASP ZAP, Nmap, Metasploit, Nuclei.
Compliance automation
Vanta, Drata, SecureFrame, Certifyi AI GRC.
Cloud and identity
AWS Security Hub, GCP SCC, Okta, Azure AD.
Industries we work with
What you receive at the end of an engagement
Executive summary
Plain language risk position, suitable for boards and investors.
Technical findings
Reproducible evidence, severity scoring, CVSS aligned ratings.
Remediation plan
Prioritised fix list with owners, effort estimates, and target dates.
Risk register
Living document, ready to feed into ISO 27001 and SOC 2 evidence packs.
Where to look next
Security services
1. Penetration testing
We look for the weaknesses an attacker would use, prove which ones are real, and tell you how to fix them.
- Web and mobile application testing
- Network infrastructure audits
- Cloud security assessment
2. GRC and security audit
Governance, risk and compliance programmes built around ISO 27001, SOC 2 and the other standards your customers ask about.
- ISO 27001 and SOC 2 readiness
- Regulatory compliance checks
- Risk management strategy
3. Security training
Training that makes your staff harder to fool and your developers less likely to ship insecure code.
- Staff awareness workshops
- Secure coding for developers
- Threat briefings for leadership
4. Phishing simulation
Controlled phishing campaigns that show who clicks, who reports, and what to train next.
- Scenarios written for your organisation
- A check of how your team responds
- A report with a training plan
5. Security advisory
Senior advice on where your security programme should go next, and in what order.
- Virtual CISO (vCISO)
- Security roadmap
- Policies and procedures
Our approach
Assess
Identifying assets and existing vulnerabilities.
Architect
Designing custom defense-in-depth strategies.
Implement
Deploying tools and security controls.
Monitor
Continuous oversight and threat hunting.
Frequently asked questions
What do GRC services cover?
Governance, risk and compliance work lines up your security policies and controls with frameworks such as ISO 27001, SOC 2, NIST CSF and the EU AI Act. We build risk registers, control libraries and evidence collection, so you can show an auditor what you do rather than describe it.
How often should we run a penetration test?
At least once a year, and again after any major release, infrastructure change or acquisition. Regulated sectors often need more frequent testing; your regulator or card scheme sets the minimum.
Do you issue ISO 27001 certificates?
No. Certificates come from accredited certification bodies. We prepare you for the audit: gap assessment, ISMS design, policies, internal audits and support during the external audit.
How do you handle AI-specific security risks?
We assess AI systems against the NIST AI Risk Management Framework, the EU AI Act and Nepal Rastra Bank AI guidance, covering data poisoning, prompt injection, data leakage and bias, and we red-team LLM applications before they go live.
What does a security or GRC engagement with Dignep involve?
An NDA, a scoping call, a written proposal within two working days, then the work itself: testing, readiness or governance. Each engagement ends with documents you can use, such as a findings report, a remediation plan, a risk register or an evidence pack, written for the person who has to sign off on them.
Audited ourselves
We are ISO/IEC 20000-1 certified for IT service management, so we know what an auditor asks for because we answer those questions too.
We build GRC and security products
We built Certifyi, an AI SaaS GRC platform, and SayCure, a 24×7 SOC platform for CryptoGen Nepal.
Findings you can act on
Each finding comes with evidence, a severity rating, an owner and a fix. Critical issues are reported the day we find them.
How an engagement runs
Timelines depend on the engagement: a penetration test is a matter of weeks, ISO 27001 readiness takes a few months. AI governance and GRC engagements start with 2–6 weeks of scoping.
We sign an NDA before any scoping conversation.
NDA and discovery call
Thirty minutes, free, under NDA. What you need to prove, to whom, and by when.
Written proposal (within 2 working days)
Scope, method, timeline, deliverables and pricing.
Scoping
Assets, systems and controls in scope, the rules of engagement for testing, and the framework you are working towards. For AI governance and GRC work this takes 2–6 weeks.
Assessment, testing or readiness work
Evidence collected as we go. Critical findings are reported straight away, not saved for the final report.
Report, remediation plan and retest
Findings with severity and owners, a prioritised fix list, and a retest or audit support once the fixes are in.
Which engagement do you need?
Most clients come to us because someone is asking for proof. This is where we would usually start.
| Your situation | Where to start |
|---|---|
| A customer has asked for your SOC 2 report or a security questionnaire | SOC 2 Type 1 readiness |
| You sell to enterprises or public bodies that want ISO 27001 | ISO 27001 readiness |
| You are launching an app or a major release | Penetration test, then a retest after fixes |
| You are putting LLMs or agents in front of customers or staff | AI governance / GRC engagement and LLM red-teaming. See AI governance and security |
| Nobody owns security, and the board keeps asking | vCISO retainer |
| Staff keep clicking suspicious links | Phishing simulation followed by training |
Pricing is scoped and quoted after a free 30-minute discovery call, with a written proposal within two working days.
When this isn't the right fit
- You need an ISO 27001 certificate issued. Only an accredited certification body can do that; we get you ready for its audit.
- You need round-the-clock monitoring. That is a managed SOC service, a different thing from an assessment.
- You want a clean report for a sales deck without fixing anything. Our reports say what we found.
SayCure SOC platform for CryptoGen Nepal
Security operations work we have built:
SayCure is a 24×7 security operations centre (SOC) platform built for CryptoGen Nepal. It brings log management, threat monitoring and vulnerability workflows into one system, run by trained analysts around the clock.
Further reading
Ready to start a security engagement?
If we run a readiness audit and find no remediation work, you do not pay for the readiness phase. NDA signed before any scoping conversation.
Book a security scoping call Call a vCISO