Starting with the paperwork
Policies are written before anyone knows the real gaps.
What we doStart with a gap assessment, then write only the policies you need.
Bridging the technology gap
We help teams prepare for the DPDP Act, SOC 2 and ISO 27001: finding the gaps, putting the policies and technical controls in place, and gathering the evidence an auditor will ask for.
Audit and certification. An independent auditor or certification body issues the report or certificate
MOUNTSMY provides compliance readiness consulting from Ahmedabad, India, for the DPDP Act, SOC 2 and ISO 27001: gap assessments, policies and procedures, technical controls such as access, logging, backups and encryption, and evidence collection. We prepare you for the audit. The audit report or certificate itself is issued by an independent auditor or certification body, and legal advice on the law comes from your lawyer.
Many teams start because a customer asks for proof of security. The work is easier when it starts early.
An example path, drawn by us. Your call shows yours.
Most are about ownership and evidence, not tools.
Policies are written before anyone knows the real gaps.
Long documents sit in a folder.
You do the right things but cannot show it.
Screenshots are gathered by hand each audit.
Compliance belongs to everyone, so to no one.
Controls decay after the audit.
Each step produces something you keep, whichever auditor you choose.
Good compliance is also good security, and good sales.
Security questionnaires answered with evidence.
Real controls, not just documents.
Evidence ready and owners who know their part.
Every control has an owner and a routine.
Monitoring that shows problems quickly.
Short training on what each person must do.
They answer different questions, and some firms need more than one.
| Item | What it is | Who often needs it |
|---|---|---|
| DPDP Act, 2023 | India's law on handling digital personal data: notice, consent, rights, safeguards and breach reporting | Organisations that process personal data of people in India |
| SOC 2 | A report by an independent auditor on controls for security and related criteria | Software companies selling to customers who ask for it, often abroad |
| ISO/IEC 27001 | A standard for an information security management system, with certification by an accredited body | Firms that want a recognised certificate and a managed security system |
We work with your team and your chosen auditor, and keep each control practical.
Understand what the law means for the way you handle personal data.
We prepare you for the audit and support you through it. The auditor stays independent.
Decide what and why.
Tell us who is asking for what.
We change nothing in this stage.
Compare today with the requirements.
Give read-only access and time with owners.
Read-only review.
Close the gaps.
Approve policies and name owners.
Changes made through your normal approval steps.
Collect and organise proof.
Keep routines running.
An internal review before the real audit.
Support the audit and keep it going.
Engage the independent auditor or certification body.
The auditor issues the report or certificate, not us.
We are an engineering team, so the controls work as well as read.
Most arise from treating it as paperwork.
This is general guidance. Confirm current requirements with your auditor or lawyer.
Most clients begin with a gap assessment.
A short review of your current position against the standard, with a ranked plan. Yours to keep.
Good for: Knowing the size of the jobA clear scope, timeline and price for a defined piece of work.
Good for: A specific goalFixes, audits and short tasks, billed by the hour.
Good for: Small or urgent jobsPart-time or full-time engineers working inside your tools, by the month.
Good for: Ongoing work and supportThe requirements differ by sector, from education data to financial platforms.
It joins security work with proof.
Something else on your mind? Ask us directly.
Ask a questionIndia's Digital Personal Data Protection Act, 2023, which sets rules for how organisations handle digital personal data, including notice, consent, people's rights, safeguards and breach reporting. Timelines are phased, so confirm current dates and requirements with your lawyer.
A report by an independent auditor on a company's controls for security and related criteria. Software companies often need it when selling to larger customers.
An international standard for an information security management system. Certification is issued by an accredited certification body after an audit.
No. An independent auditor or certification body does. We prepare you and support the audit, which keeps the audit independent.
No. It is practical guidance. For legal interpretation of the DPDP Act or contracts, speak to a lawyer.
It depends on your size and starting point. After a gap review you get a plan with stages and dates.
Yes. We are an engineering team, so we set up access, logging, backups, encryption and monitoring, not just policies.
If customers or regulators ask for it, yes. A smaller scope can be a good way to start.
It depends on the standard, the scope and your starting point. After a free call you get a written plan and quote.
Yes. We explain what to ask and help you compare, and then step back so the audit stays independent.
Book a free 30-minute call with an engineer. We’ll send a written plan and quote after.