Service area · Ahmedabad, India · Reviewed September 2026
Tranquility Cybersecurity serves Ahmedabad and Gandhinagar as part of its India service area from its Gurugram headquarters, with on-site visits to GIFT City, the SG Highway corridor and Gandhinagar Infocity when an audit calls for it. Ahmedabad buyers typically come to us for ISO 27001 and ISO 22301 for the IFSCA- and RBI-regulated fintech, fund and banking units that answer to a regulator, SOC 2 for IT services and SaaS firms selling to US and European clients, DPDP Act readiness for consumer and financial platforms, and PCI DSS scoping for the payment flows that run through the city’s fintech and e-commerce operators.
Quick facts
The local picture
Ahmedabad’s compliance demand has two distinct centres of gravity. The first is GIFT City in Gandhinagar — India’s international financial services centre — where banking units, fund managers, fintech sandbox participants, broker-dealers and insurance intermediaries operate under the International Financial Services Centres Authority (IFSCA) and are increasingly asked to demonstrate structured cyber-security and business-continuity arrangements. The second is the city’s broader economy: the IT services and SaaS firms along the SG Highway corridor and at Gandhinagar Infocity, a large pharmaceutical and API manufacturing base, and the textile, chemicals and engineering manufacturers of the wider region that are digitising their operations and supply chains. Each group answers to a different regulator or buyer, and that decides which framework comes first.
Banking units, fund managers, fintechs and intermediaries in GIFT City are expected to evidence cyber-security governance, resilience and incident handling. ISO 27001 and ISO 22301, with periodic VAPT, are the usual way that evidence is organised.
Lending, payments and wealth platforms outside GIFT City sit under RBI’s directions, process personal financial data at scale under the DPDP Act, and face PCI DSS scoping on card flows.
SG Highway and Infocity firms selling to US, UK and EU customers are asked for SOC 2 reports and ISO 27001 certificates in procurement.
Ahmedabad’s pharmaceutical manufacturers and their contract-research partners face client and regulator expectations on data integrity and system security; ISO 27001 scoped to laboratory, quality and business systems is the common ask, with HIPAA alignment for those handling US patient data.
Manufacturers adopting ERP, e-commerce and connected-plant systems are asked by large customers and lenders for evidence of security and continuity; ISO 27001 and ISO 22301 scoped to business-critical systems fit here.
What we deliver in Ahmedabad
The certificate IFSCA- and RBI-regulated entities, Indian banks and enterprise buyers recognise. ISMS scoping, risk assessment, the 93 Annex A controls, internal audit and certification-body coordination — built so it can carry ISO 22301 alongside it for regulated units.
ISO 27001 consultingThe report US and European buyers ask SG Highway and Infocity exporters for. We scope the Trust Services Criteria, design and implement controls, collect evidence and coordinate the licensed CPA firm through to the signed Type I or Type II report.
SOC 2 consultingFor GIFT City units, fintechs and manufacturers whose regulators and customers ask for tested continuity: business impact analysis, recovery strategies, exercises and certification-body coordination, aligned with the ISO 27001 ISMS.
ISO 22301 guideFor the fintechs, NBFCs, e-commerce operators and consumer platforms in Ahmedabad that are data fiduciaries under the Digital Personal Data Protection Act 2023: data mapping, consent and notice flows, grievance handling and breach-notification readiness under the DPDP Rules.
DPDP complianceFor payment aggregators, fintechs and e-commerce operators that store, process or transmit card data: scoping and segmentation, gap assessment against PCI DSS v4.0, remediation and preparation for the QSA assessment or self-assessment questionnaire.
PCI DSS guideManual-first penetration testing that satisfies SOC 2 auditors, ISO 27001 control A.8.8 and IFSCA or RBI expectations. Where a regulator requires a CERT-In empanelled report, we deliver with CERT-In empanelled partners.
VAPT servicesLaws and regulators
Plain-English summary as of September 2026. Laws change; confirm current obligations with counsel before relying on any line here.
| Law / regulator | Who it covers | What it means in practice |
|---|---|---|
| IFSCA cyber-security and resilience expectations | Banking units, fund managers, fintech entities, broker-dealers and insurance intermediaries operating in GIFT City under the International Financial Services Centres Authority. | IFSCA issues its own frameworks and circulars for regulated entities, covering governance, cyber-security controls, resilience and incident reporting. Requirements vary by entity type; ISO 27001 and ISO 22301 are commonly how regulated units organise the evidence, and structured VAPT is typically expected. |
| RBI IT governance and cyber-security directions | Banks, NBFCs, payment aggregators and lending fintechs headquartered or operating in Ahmedabad outside the IFSC. | Board-level IT governance, periodic VAPT, incident reporting, continuity testing and vendor oversight. ISO 27001 and ISO 22301 map well to these expectations and are often how the evidence is organised. |
| Digital Personal Data Protection Act 2023 and DPDP Rules | Every Ahmedabad company that processes digital personal data of individuals in India — fintechs, NBFCs, e-commerce, hospitals, HR and payroll systems. | Consent and notice obligations, data-principal rights, breach notification to the Data Protection Board and affected individuals, and heavier duties for Significant Data Fiduciaries. Enforcement phases in under the Rules; readiness work should start now rather than at the deadline. |
| CERT-In cyber-security directions (2022) | All service providers, intermediaries and body corporates in India, including GIFT City units and SG Highway exporters. | Six-hour incident reporting to CERT-In, log retention, and synchronised clocks. An incident-response playbook that meets CERT-In, IFSCA or RBI, and SOC 2 expectations avoids doing the work three times. |
| PCI DSS and other client-side obligations | Any Ahmedabad company handling card data, US health data or EU personal data for its customers or clients. | PCI DSS applies by card-brand and acquirer contract, not by statute; HIPAA business-associate duties and GDPR processor obligations flow down the same way. We map them onto one control set instead of running parallel programmes. |
How we serve Ahmedabad
Our Gurugram team works in the same IST working day as your Ahmedabad or GIFT City team; workshops and evidence reviews run over video with shared trackers.
On-site when it matters: kick-off, control walkthroughs at GIFT City, SG Highway or Infocity offices, and audit days with the CPA firm, certification body or QSA.
Named lead auditors and CISA-certified practitioners run the engagement end to end — no hand-off to a junior team after the sale.
One combined programme for regulated units that need ISO 27001, ISO 22301 and DPDP together: shared risk assessment, one policy set, one evidence library.
Fixed fee agreed in writing after a short scoping call; CPA, certification-body and QSA fees are quoted separately and we help you scope them.
Pricing
Indicative bands for Ahmedabad and GIFT City engagements. Scope, headcount, cloud footprint and starting maturity move the number; we give you a fixed figure in writing after a 30-minute scoping call.
| Engagement | Indicative band | Note |
|---|---|---|
| SOC 2 readiness consulting (Type I or Type II) | ₹2–4 lakh | CPA attestation fee quoted separately by the licensed CPA firm. |
| ISO 27001:2022 implementation and internal audit | ₹1–3 lakh | Certification-body fees separate. |
| DPDP Act readiness | Scoped to data volume and fiduciary status | Includes data mapping, consent flows and breach playbook. |
| VAPT (web application, typical SaaS scope) | ₹40,000 – ₹1.5 lakh per test | Retest included; CERT-In empanelled partner where required. |
| vCISO / vDPO retainer | Monthly retainer, scoped to hours | Named practitioner, board and regulator-facing. |
Straight answers for Ahmedabad companies on SOC 2, ISO 27001, local regulation, timelines and cost.
No. Ahmedabad and Gandhinagar are part of our India service area. We are headquartered in Gurugram and serve the city from there, with on-site visits for kick-off, control walkthroughs and audit days. Most of a SOC 2 or ISO 27001 engagement runs over video and shared trackers regardless of where the consultant sits.
IFSCA sets its own expectations for regulated entities, and they vary by licence type — a banking unit, a fund manager and a fintech sandbox participant do not carry identical obligations. In practice, most units are expected to show governance, a documented control framework, periodic testing, continuity arrangements and incident reporting. We read the circulars that apply to your licence, scope an ISO 27001 ISMS and, where needed, ISO 22301 to evidence them, and coordinate the certification body.
Within the IFSC, IFSCA is the unified regulator, so a GIFT City entity generally answers to IFSCA rather than to RBI, SEBI or IRDAI directly. A group that also runs a domestic entity outside GIFT City will have that entity under the domestic regulator. We build one control set that satisfies both where a group straddles the boundary, and we recommend confirming the precise regulatory position with your legal counsel.
It depends on how much card data you touch and what your acquirer or card brands require. Many fintechs and e-commerce operators can reduce scope by tokenising and routing card data through a compliant payment aggregator, then complete a self-assessment questionnaire. Higher transaction volumes or direct card storage bring a QSA assessment. We scope first, shrink the environment where possible, and prepare the evidence for whichever route applies.
It depends on who is asking. US and many European enterprise buyers ask for a SOC 2 report, increasingly Type II. Indian banks, GIFT City counterparties and government buyers recognise ISO 27001. If both are on the horizon, we build one control set and sequence the two audits so evidence is collected once.
A SOC 2 report is issued by an independent licensed CPA firm operating under AICPA standards. ISO 27001 and ISO 22301 certificates are issued by accredited certification bodies. A PCI DSS Report on Compliance is issued by a Qualified Security Assessor. TCSA prepares you, runs the internal audit and coordinates the assessor; it does not issue any of them, and no consultant legitimately can.
Yes. The ISMS scope statement defines which sites, systems and business units are covered, and pharma manufacturers commonly start with laboratory, quality-management and ERP systems where data-integrity expectations are highest, then extend to plant OT later. What matters is that the scope matches what customers and auditors are relying on.
Fixed fee, agreed in writing after a scoping call. Typical Ahmedabad bands are ₹2–4 lakh for SOC 2 readiness consulting and ₹1–3 lakh for ISO 27001 implementation. CPA attestation, certification-body and QSA fees are quoted separately by those firms, and we help you scope them so there are no surprises.
Keep Exploring
Fixed-fee, lead-auditor-run certification programs.
Read moreAuditor-led SOC 2 readiness and CPA coordination for Indian teams.
Read moreCSITE, IT governance and incident reporting for RBI-regulated entities.
Read moreWhat a BCMS is, who demands it, and how certification works.
Read morePayment card data security for merchants and service providers.
Read moreDPDP Act readiness ahead of the 2027 deadline.
Read moreAlso served
Talk to a real auditor
Book a free 30-minute call. We will tell you which framework your buyers or regulator actually need, what it will cost, and how long it takes — and whether we are the right fit.
