How Cargoflash runs five frameworks off one control set

One programme, many standards.

As Cargoflash’s virtual CISO we run its security programme with its IT and compliance teams, who review and approve the documents we write.

Control set

In June 2025 we drafted Cargoflash’s unified control framework, and our vCISO circulated it in July. It holds 214 controls mapped across ISO 27001, SOC 1, SOC 2, GDPR and the DPDP Act, plus 14 secure development controls, seven for design and seven for build. Evidence is collected every quarter into one repository, filed by control family, so one piece of evidence can answer every framework that asks for it.

ISO 27001

We took Cargoflash through ISO/IEC 27001:2022 certification in June 2025. The certificate covers the design, development, implementation, support and secure delivery of its air cargo management solutions and digital platforms, including the nGen suite and the Octo products. In May 2026 we took the company through its first surveillance audit, and the surveillance certificate was issued in June.

SOC 1 and SOC 2

We ran Cargoflash’s SOC 1 Type II and SOC 2 Type II engagement on the nGen and Octoloop platforms, for April 2024 to March 2025. The SOC 2 scope took in all five Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. A CPA firm attested both reports, and we delivered the signed copies to Cargoflash in June 2025. In July 2026 Cargoflash approved the next cycle, built as one control set, one evidence base and two attested reports, and it is under way.

Security testing

In 2025 we set up a firewall configuration review for Cargoflash, run from May to July, and regular ASV scans, both delivered with our CERT-In empanelled partners.

Threat response

In July 2025 an airline customer warned Cargoflash about a group targeting airlines. The day the warning reached our vCISO, we drafted a tiered response plan for leadership to finalise: an immediate hunt in the SIEM for known indicators, then a review of privileged accounts and MFA, a phishing simulation, a vulnerability scan and vendor readiness checks, and in the mid term a tabletop exercise and a review of segmentation and zero trust.

AI governance

In September 2025 we set up a short session on AI guardrails for Cargoflash’s IT, security and leadership stakeholders and the group’s legal team. The same month we gave leadership a foundational AI risk register for third-party AI tools, aligned with ISO/IEC 42001. In August 2026 we updated the AI usage guidelines and the employee undertaking for agentic AI tools, with a new section on connecting only what a task needs, manual approval wherever client data or money is involved, and using only connectors IT has approved. The group’s legal team cleared both.

Unified assessment

From October 2025 to January 2026 we assessed Octoloop, nGen, OctoCharter, OctoAccess and Cargoflash’s AI and machine learning systems against ISO 27001, ISO 27701, ISO 42001, SOC 1, SOC 2, GDPR and the DPDP Act, in one unified assessment. Cargoflash received one assessment report and one unified risk register for all of them.

ISMS documents

In September 2026 we began rebuilding Cargoflash’s ISMS documentation around how the company runs: the nGen suite, Octoloop, its production and disaster recovery environments, and named roles. The documents sit under one master register and one numbering scheme. That month Cargoflash approved the master register and the ISMS manual, then five more documents, the information security policy among them.

Group Concorde

In September 2025 we agreed the ISO 27001 scope for Ascent Air and Acumen Overseas with Group Concorde’s legal team. It covers airline representation and general sales and service agent work across India, for passenger services, cargo services and flight clearing, at five sites each: Gurugram, New Delhi, Mumbai, Bengaluru and Kerala for Ascent Air, and Gurugram, New Delhi, Mumbai, Chennai and Hyderabad for Acumen Overseas. Both companies were certified to ISO/IEC 27001:2022 in October 2025. We also wrote a policy suite for each company, 33 policies and 2 procedures, which the group’s legal team reviewed and accepted.

Virtual DPO

In 2025 we provided virtual DPO services to Group Concorde. Its legal team set out the data protection templates it needed, and we worked through that list, keeping the deliverables checklist up to date and uploading policies against it as we went.