Govern · Services
Governance, risk and compliance at Fidova is designed to help work move: controls that people can follow, ownership that is unambiguous, and evidence produced as a by-product of doing the work properly. We design controls into the process rather than beside it, cut controls that do not reduce real risk, and hold to the principle that a control a process owner cannot operate is the wrong control. Where an organisation faces several frameworks at once — ISO 27001 structure, SOC 2 criteria, data protection law — we map controls once so one control set serves many requirements. We prepare you thoroughly for audit and certification and produce the evidence they demand, but we are explicit that the certificate itself is issued by an accredited body, not by us. The connected view matters because the same firm can turn a security finding or an ERP access requirement into an operating control with an owner and evidence, rather than leaving it as a recommendation.
In short
Fidova's governance, risk and compliance practice turns obligations and risk decisions into controls, clear ownership, and evidence that teams can actually operate. We design controls into the work rather than beside it, so governance helps work move instead of slowing it, and we prepare organisations for audit and certification without being a certification body ourselves.
Start a conversation
What we do
Establish how risk is identified, assessed, escalated, and accepted, in language the business uses rather than a register nobody reads. We set out what the organisation is willing to accept and who may accept it, so decisions are made deliberately rather than by default. The outcome is a framework that informs real decisions instead of satisfying a policy requirement.
Design controls that fit the process they govern, and remove duplicated or unenforceable controls that only create work. We map each control to the requirement it satisfies, so one well-placed control can serve several obligations at once. The result is a leaner control set that reduces more risk with less friction.
Write policy that is short enough to be read and specific enough to be followed, mapped to the obligations behind it. Policy nobody reads protects no one, so we write to the people who must comply rather than to the auditor. Each statement traces back to the obligation it answers, so its purpose is never in doubt.
Establish lawful basis, records of processing, retention, subject rights handling, and privacy review for new initiatives. We build the records and routines that let you answer a regulator or a customer with evidence rather than assurances. Where a formal legal opinion is required, we tell you to obtain one rather than improvise it.
Assess and monitor the risk suppliers introduce, with proportionate due diligence and contractual requirements. We scale the scrutiny to what a supplier actually touches, so critical suppliers get real attention and minor ones are not over-governed. The outcome is a supplier risk process that is sustainable rather than a one-off questionnaire exercise.
Prepare for internal, customer, or certification audits by making evidence continuous rather than a scramble. We arrange for evidence to accumulate from normal operation, so an audit confirms what is already true instead of triggering a fire drill. Remaining gaps are stated plainly, so there are no surprises in the audit itself.
Sub-services
Each service below has its own page setting out the work, the deliverables and the questions buyers ask before starting.
GRC advisory brings governance, risk and compliance into one operating picture, so obligations are met without duplicating effort. It treats the three as a single discipline with shared controls, owners and evidence rather than three parallel programmes competing for the same people.
Enterprise risk management gives leadership a consistent view of the risks that could prevent the organisation meeting its objectives. It is the process by which those risks are identified, compared on the same terms, owned by someone accountable and escalated before they crystallise.
IT risk assessment evaluates the technology risks — availability, integrity, obsolescence, supplier and change risk — that threaten operations. It covers the risks that materialise without any attacker, which a security-only view tends to miss.
Cyber risk assessment quantifies the likelihood and impact of credible cyber scenarios against your organisation. It answers what an incident would actually cost and which of your controls would interrupt it, rather than cataloguing weaknesses in the abstract.
Regulatory compliance work establishes which regulations apply to you, what they require operationally, and how compliance is evidenced. It turns legal text into specific controls and the records that demonstrate they operate.
Information security governance establishes who decides, who owns and who reports on security across the organisation. It is the structure of accountability and decision-making that turns security spending and policy into outcomes.
Security policy and framework development produces documentation short enough to read and specific enough to follow. It gives each policy a real obligation behind it and an owner in front of it, so the set stays current instead of ageing in a shared drive.
ISO 27001 consulting and implementation builds and operates an information security management system ready for certification. It produces a system that runs and generates evidence, not a folder of documents that satisfies nobody at the audit.
SOC 2 readiness prepares your controls and evidence for a service auditor's Type I or Type II examination. It focuses on building evidence that accrues continuously, since a Type II report rests on how controls operated across a period rather than on a single point in time.
PCI DSS compliance work establishes cardholder data scope and the controls needed to meet the standard at your level. The cheapest and safest path is almost always to reduce scope first, so that fewer systems fall within the standard at all.
GDPR compliance work establishes lawful basis, records, rights handling and transfer arrangements for personal data. It is built to operate in the systems and teams that handle the data, rather than to sit as a policy nobody consults.
HIPAA compliance work implements the safeguards and agreements required when handling protected health information. There is no official HIPAA certificate, so compliance is shown through a documented risk analysis, implemented safeguards and the evidence behind them.
NIST framework implementation uses the Cybersecurity Framework to assess maturity and plan improvement across functions. It is a structured way to decide where to invest, not a certification, and its value is in the roadmap it produces.
Business continuity and disaster recovery planning establishes how the organisation keeps operating and recovers when systems or sites fail. An untested plan is an assumption, so the work is only finished once an exercise has shown it holds.
Third-party risk management controls the risk your suppliers, processors and partners introduce across their lifecycle. It is organised by what each supplier can actually affect, so scrutiny lands where it matters and routine purchases are not held up.
Vendor risk assessment evaluates a specific supplier's security, privacy and resilience posture before or during engagement. It reads behind the certificates and questionnaire answers to what is actually covered, and ends in a clear recommendation.
Internal IT audits independently test whether technology controls are designed well and operating as described. They replace the assertion that controls work with evidence of whether they actually did over the period examined.
A compliance gap assessment measures your current position against a framework or obligation and states what is missing. It is deliberately short, because its job is to inform a decision about scope, budget and timing, not to become the programme itself.
Control testing and assurance verifies with evidence that controls operated as intended over a period. Done on a cycle, it turns the annual scramble for evidence into a by-product of controls simply running.
Data privacy and protection work establishes lawful, minimised and secure handling of personal data across its lifecycle. It maps the obligations of the regimes that apply to you — including India's DPDP Act and GDPR where relevant — onto one control set rather than running separate programmes.
Risk register management keeps the register accurate, owned and used — rather than a document reviewed once a year and trusted by no one. Its value lies in the discipline around it: specific statements, consistent scoring, named owners and a cadence that keeps it current.
Audit readiness and support prepares the organisation, evidence and people for an external audit, and supports it while it runs. A gap disclosed with a remediation plan is handled far better than one the auditor discovers, which is the principle the whole exercise follows.
Security awareness and compliance training gives staff the specific knowledge their role requires, with records that satisfy obligations. Generic training tied to nobody's actual job changes little behaviour and convinces no auditor.
What you receive
Every engagement produces documented output your teams keep and can act on without us in the room.
When this work helps
How an engagement runs
Establish the obligations, decision rights, and risks that genuinely matter to this organisation. We separate the requirements that truly apply from those assumed to, so effort is not spent governing risks you do not carry.
Review existing controls, policy, evidence, and how the work is actually performed. We compare the control on paper with the control in practice, because the gap between the two is usually where the real risk sits.
Design a proportionate control set with named ownership, evidence, and review cadence. Every control has an owner who can operate it and a defined source of evidence, so nothing depends on memory or heroics.
Embed the changes with the teams doing the work, and test that the controls operate. We hand over controls the process owners can run themselves, rather than a framework only we understand.
Where we work
Fidova provides governance, risk and compliance consulting from Delhi, India, and works with organisations operating in several jurisdictions at once, mapping obligations across regions to one coherent control set.
Engagements run in English, are scheduled around your time zone, and can be delivered remotely end to end. Where a phase benefits from being in the room — discovery workshops, go-live support, or on-site review — we plan that time explicitly.
Connected expertise
Questions
Straight answers to what buyers ask us before an engagement begins.
Next step
