Cybersecurity and GRC services
Seven practice areas across audit, assessment, offensive security, advisory, leadership, and uptime monitoring.
ISO 27001 / 27701 / 42001: Gap Assessment, Implementation & Audit Readiness
Structured gap assessment and implementation for ISO 27001, ISO 27701, and ISO 42001. Control frameworks and evidence trails built for certification bodies — not template decks.
Banks, FinTechs, insurers, and IT service organisations in Nepal preparing for ISO/IEC 27001:2022 certification — or extending to ISO/IEC 27701 (privacy) or ISO/IEC 42001 (AI management). Also suited to teams with an existing ISMS that need a credible gap assessment before internal audit or certification body review.
How we work
- 1
Gap Assessment
Baseline your current controls against the applicable standard clauses and Annex A controls, with evidence review and stakeholder interviews.
- 2
Remediation Roadmap
Prioritised plan mapping gaps to owners, timelines, and resource needs — sequenced for certification readiness, not checkbox closure.
- 3
Implementation Support
Hands-on support building policies, procedures, risk treatment, and operational controls aligned to how your organisation actually works.
- 4
Internal audit readiness
An internal audit against the standard, performed by consultants who did not implement the controls being audited, so findings are objective before the certification body arrives.
- 5
External Audit Coordination
Support through stage 1 and stage 2 certification audits, including evidence preparation and auditor response.
What you receive
- Gap assessment report with clause-level findings and maturity ratings
- Remediation roadmap with prioritised actions and ownership
- ISMS / PIMS / AIMS documentation pack (policies, procedures, SoA)
Information Security Audit — NRB & NIA Regulatory Compliance
Independent IS audits aligned to NRB and NIA supervisory requirements. SWIFT Customer Security Programme (CSP) assessment capability for institutions on the SWIFT network.
NRB-regulated commercial banks, development banks, finance companies, and microfinance institutions subject to Nepal Rastra Bank information systems audit requirements. NIA-regulated life and non-life insurers subject to Nepal Insurance Authority IT and information security supervisory expectations. SWIFT member institutions needing Customer Security Programme (CSP) gap analysis or attestation support ahead of annual reporting cycles.
How we work
- 1
Engagement & Scope
Align audit scope to your regulatory filing, prior audit findings, and NRB/NIA circular requirements — including SWIFT CSP controls where applicable.
- 2
Document Review
Review IS policies, risk assessments, access management records, change logs, incident registers, and vendor due diligence evidence.
- 3
Control Testing & Fieldwork
Test key controls through sampling, configuration review, and interviews with IT, security, and business process owners.
- 4
Findings Validation
Validate observations with your team before finalisation — factual, evidence-backed findings rated by risk and regulatory impact.
- 5
Audit Report & Management Letter
Issue the formal audit report and management letter in a format suitable for board, regulator, and remediation tracking.
What you receive
- Information systems audit report aligned to NRB or NIA supervisory expectations
- Findings register with risk ratings and regulatory reference where applicable
- Management letter for board and senior leadership
Vulnerability Assessment & Penetration Testing
Systematic VAPT across web, API, mobile, and network targets. Prioritised findings with reproducible evidence and remediation guidance your engineering teams can act on.
Organisations that need to prove what is exploitable before an audit, regulator review, or production release — including banks and FinTechs, software product teams, and enterprises with internet-facing applications or APIs. Suitable when you need scoped testing of defined targets, not a full red team programme.
How we work
- 1
Scoping
Define in-scope assets, testing boundaries, rules of engagement, and success criteria with your technical and business owners.
- 2
Assessment
Vulnerability scanning and manual penetration testing across agreed targets — web, API, mobile, or network — using OWASP-aligned methods.
- 3
Findings
Document each finding with reproducible steps, evidence, severity rating, and practical remediation guidance for your engineering team.
- 4
Retest
Retest remediated findings and issue confirmation of closure — or document residual risk where fixes are deferred.
What you receive
- Technical penetration test report with step-by-step reproduction evidence
- Executive summary for leadership and audit stakeholders
- Findings register with severity ratings and remediation recommendations
Offensive Security & Red Team Engagements
Adversary simulation and red team exercises that test detection, response, and control effectiveness — a higher-tier engagement than scoped VAPT, aligned to realistic attack objectives.
Mature security programmes — typically banks, FinTechs, and critical infrastructure operators — that have already addressed baseline vulnerabilities and want to test whether detection, response, and governance hold under realistic attack pressure. Not a substitute for a first VAPT; this is the next tier when you need to know if your SOC, IR process, and controls work together.
How we work
- 1
Objectives & Threat Profiling
Define attack objectives, scope boundaries, and threat scenarios aligned to your risk profile and regulatory context.
- 2
Reconnaissance & Initial Access
Simulate adversary recon and entry using agreed TTPs — phishing, external exploitation, or assumed-breach scenarios as scoped.
- 3
Lateral Movement & Objective Execution
Pursue agreed goals such as privilege escalation, data access paths, or control bypass — within rules of engagement.
- 4
Detection & Response Review
Document what was detected, when, and by whom — and where monitoring, alerting, or IR processes did not surface activity.
- 5
Debrief & Purple Team Workshop
Walkthrough with your blue team and leadership; optional purple team sessions to translate findings into detection and control improvements.
What you receive
- Red team engagement report with attack narrative and timeline
- Objective achievement summary and evidence artefacts
- Detection and response gap analysis
Information Security & Cybersecurity Consultation
Project-based advisory on architecture, control design, and incident readiness. Defined scope and deliverables — distinct from an ongoing vCISO retainer.
Organisations facing a specific security decision or deadline — a new system launch, vendor selection, incident readiness gap, architecture review before audit, or a board briefing on a defined risk topic. Suited when you need senior practitioner input on a bounded problem, not an embedded security executive on retainer.
How we work
- 1
Problem Definition
Agree the decision to be made, stakeholders, constraints, and what "done" looks like for this engagement.
- 2
Current-State Review
Review relevant architecture, controls, documentation, and interviews with your technical and business owners.
- 3
Options & Recommendations
Present assessed options with trade-offs, risk implications, and a clear recommendation — not open-ended slide decks.
- 4
Deliverable Handover
Issue agreed outputs in a format your team can act on — memo, assessment report, or briefing materials.
- 5
Follow-Up Review
Optional checkpoint after implementation to validate that recommendations were applied correctly.
What you receive
- Scoped advisory report or architecture assessment memo
- Risk assessment and treatment recommendations (where in scope)
- Vendor or technology security review summary
vCISO / vISO: Strategic Security Leadership
Fractional CISO and ISO leadership on retainer — governance, risk management, and board reporting without full-time headcount. Practitioner-led GRC for regulated environments.
Banks, insurers, FinTechs, and mid-size enterprises that need executive-level security governance — risk registers, policy frameworks, regulator and board reporting — without hiring a full-time CISO. Especially relevant for NRB-regulated institutions building or maturing an information security function under supervisory scrutiny.
How we work
- 1
Baseline & Risk Assessment
Establish current security posture, regulatory obligations, and top risks with leadership alignment on priorities.
- 2
Programme Design
Define the security roadmap, policy framework, metrics, and governance structure for the retainer period.
- 3
Operating Rhythm Embedding
Establish steering committee cadence, incident escalation paths, and remediation tracking integrated with your teams.
- 4
Ongoing Governance & Reporting
Monthly or quarterly reporting to leadership, audit committee, and regulators as required — with honest risk status, not green-washing.
- 5
Annual Programme Review
Reassess roadmap, budget, and control maturity; adjust priorities for the coming cycle.
What you receive
- Maintained risk register and treatment tracking
- Security programme roadmap with milestones
- Policy and standards suite — drafted or reviewed on an ongoing basis
Uptime Status Monitoring
Know the moment your website, app, API or payment integration goes down — before your customers do. Outside-in checks, instant alerts and a branded status page, run by TTPL or on your own VPS.
Banks, insurers, wallets, fintechs, ISPs and online businesses whose customers log in, pay or buy online — including checkouts that depend on eSewa, Khalti, Fonepay, connectIPS or NepalPay. Choose TTPL Managed from NPR 299/month, or You Managed on your own VPS with a yearly AMC.
How we work
- 1
Choose Your Model & Plan
TTPL Managed on TTPL servers, or You Managed on your own VPS — each in a Standard or Premium package.
- 2
Endpoint Setup
Websites, APIs, SSL certificates, ports and DNS checked every 5 minutes, 1 minute or 30 seconds, depending on how critical each one is.
- 3
Instant Alerts
Email, Slack, Teams and Telegram on every plan; WhatsApp, SMS and phone calls on Premium. Retries first, so a single slow response does not wake you up.
- 4
Status Page & Reporting
A branded status page, a Status API for an "all systems operational" dot, and monthly uptime reports you can show to customers and regulators.
What you receive
- Outside-in monitoring of websites, APIs and payment integrations
- Branded public status page and Status API
- Uptime logs and monthly reports with incident history
How we stay independent
We do not audit our own work. Internal audits are performed by consultants who were not involved in implementing the controls under review, in line with ISO/IEC 27001:2022 clause 9.2.2.
We are not a certification body and do not issue ISO certificates. We prepare you for the certification body you choose.
We do not operate and audit the same environment in the same period.
We do not perform NRB or NIA regulatory IS audits for any organisation where we provide vCISO or implementation services, during that engagement or for 12 months after it ends.
Managed security tooling
SIEM, uptime and system monitoring, reverse proxy and a team password manager: deployed, hardened and handed over with runbooks.
Need something custom?
Discuss your threat profile →