GRC services from an in-house expert team
We work on whichever GRC platform you choose, on MarshalGRC, or with no platform at all. The advice is the same either way.
Three ways to work with us
On MarshalGRC
Program design and build delivered straight onto the platform, ready to run.
On your existing platform
We configure and operate the program in the GRC tool you already license.
Without a platform
Assessments, audits and advisory delivered as documents and working files you own.
Cybersecurity
ISO/IEC 27001, SOC 2, NIST CSF, SANS
- Internal control structure advisoryDesign of the security control set and ownership model.
- VAPTVulnerability assessment and penetration testing.
- Internal auditIndependent testing of control design and operation.
- Risk assessmentsIdentification and scoring of cyber risk across your environment.
- Maturity assessmentsWhere your program stands today and what the next level requires.
Business continuity and disaster recovery
ISO 22301, NIST BCM, DRI framework
- Internal control structure advisoryContinuity governance, roles and control design.
- Business impact analysisCritical processes, dependencies and recovery objectives.
- BCP and DR designContinuity and recovery plans that match your BIA.
- DR exercisesPlanning, running and reporting on recovery tests and tabletops.
- Internal auditIndependent review of the continuity program.
- Maturity assessmentsProgram maturity measured against the standard.
Data privacy
India DPDP Act, GDPR, HIPAA, PIPEDA, PDPL
- Privacy program advisoryGovernance, policies and accountability for personal data.
- Data-flow mappingWhere personal data is collected, stored and shared.
- Data protection impact assessments (DPIAs)Risk review of new processing, products and data-sharing partners.
- Consent and notice controlsIncluding sensitive categories such as health and minors' data.
- Regulatory readiness and gap assessmentAgainst the laws that apply to your markets.
- Internal auditIndependent testing of privacy controls.
AI governance
ISO/IEC 42001, NIST AI RMF
We give your Responsible AI principles a control framework, an evidence trail and independent assurance behind them.
- AI management system designAn ISO 42001-aligned governance structure for how AI is built and used.
- AI inventory and AI risk registerWhich AI systems you run, the risks each one carries, and who owns them.
- Policy and oversightAI policies, working groups and review checkpoints.
- Internal audit of AI systemsIndependent testing of AI controls and oversight.
- Certification readinessPreparation for an ISO 42001 certification audit.
Third-party risk management
ISO 27001, SOC 2, FFIEC guidance, DPDP Act, GDPR
- Due diligence and onboardingSecurity and privacy review of new vendors and data-sharing partners.
- Risk tieringPartners classified by the data they hold and how critical they are.
- Contracts and data-processing agreementsSecurity terms, DPAs and data-sharing agreements reviewed or drafted.
- Assurance report reviewCritical reading of vendors' SOC 2 reports and ISO 27001 certificates.
- Periodic reassessmentReviews scheduled by risk tier, not left to contract renewal.
- OffboardingData return, deletion and access removal confirmed at exit.
IT service management
ITIL, ISO/IEC 20000
- Internal control structure advisoryControls over change, incident, problem and access management.
- Process assessmentITSM processes reviewed against good practice.
- Internal auditIndependent testing of IT general controls.
- Maturity assessmentsService management maturity and a roadmap to improve it.
EHS and industrial safety
ISO 45001, ISO 14001
- Internal control structure advisorySafety and environmental management controls.
- Risk assessmentsHazard identification and risk scoring.
- Internal auditCompliance audits against standards and local regulation.
- Maturity assessmentsProgram maturity and certification readiness.
Quality management systems
ISO 9001
- QMS design and documentationProcesses, procedures and records for a working quality system.
- Internal auditIndependent audits of the quality system.
- Maturity assessmentsGaps against the standard and a plan to close them.
- Certification readinessPreparation for the certification body's audit.
Sectors we serve
Different data carries different obligations. We start from what your data is, whose it is and who you share it with.
Healthcare and life sciences
Data at stakeClinical and patient data shared across hospital networks
Typical obligationsDPDP Act, HIPAA, PIPEDA, clinical-trial governance (GCP)
Education and edtech
Data at stakeStudents' behavioural and digital data, including minors'
Typical obligationsChild-data consent, DPDP Act provisions for minors, FERPA
Financial services
Data at stakeCustomer financial and behavioural data
Typical obligationsGLBA, SOX, FFIEC and OCC guidance, NY DFS Part 500
Mining and industrial
Data at stakeWorkforce fatigue, readiness and occupational-safety data
Typical obligationsOccupational-safety reporting and liability, ISO 45001
Government and public sector
Data at stakePopulation-scale data shared across agencies
Typical obligationsSOC 2, ISO 27001 and DPIAs as procurement requirements