Scope and responsibility map
Identify delivery entities, teams, locations and systems. Separate customer, headquarters and local responsibilities, including evidence access and escalation authority.
Customer commitments. Everyday delivery.
ISO 27001 consulting for Indian delivery teams.
A new customer contract can expose gaps between group policies and the way an Indian delivery team actually works. CyberVantage360 helps organisations define ISO 27001 scope, organise implementation and prepare evidence for independent certification. Turn customer commitments into clear actions for delivery managers, technology owners and staff.
Start with the operating decision
Explain what the Indian operation controls.
For a global capability centre, headquarters may own policy and infrastructure while the Indian operation manages people, development or support. Record the decisions made locally and the evidence supplied by other entities. A group document cannot answer a question about an operating activity it does not describe.
For a software or outsourced-service provider, begin with customer commitments, delivery locations, development environments and support access. Distinguish customer-managed systems from company-managed systems, then agree how exceptions and incidents cross that boundary.
ISO's current catalogue identifies ISO/IEC 27001:2022 as the ISMS standard. Use a risk-based programme to connect the intended certification scope to practical operating responsibilities. The goal is a system that staff can follow after the initial audit preparation ends.
India context
Keep the obligations register current.
MeitY's official catalogue includes the Digital Personal Data Protection Act, 2023 and Rules, 2025. An implementation plan should use the actual instruments and relevant commencement dates, rather than the older description of an upcoming bill. Confirm applicable duties with the responsible privacy and legal owners.
Use discovery to record where customer, employee and support information is processed, which entity makes the decisions and which suppliers participate. The ISMS can supply evidence of security arrangements; certification does not by itself establish compliance with all Indian or overseas customer requirements.
Keep contractual reporting contacts and operational escalation routes together. A delivery manager should know who can authorise a response, where the facts are collected and how to reach the customer's decision-maker outside normal local working hours.
Agreed outputs
Give delivery teams clear work and usable records.
Agree the programme around the services being sold and the controls your teams must operate.
Risk and control implementation plan
Prioritise risks affecting customer information and service delivery. Name accountable owners and connect treatment decisions to the Statement of Applicability.
Role-specific operating instructions
Develop practical joiner, mover, leaver, development and support workflows. Clarify what staff should do when a customer request conflicts with the normal process.
Evidence and internal review pack
Organise operating records, internal audit findings, corrective actions and management decisions. Establish ongoing ownership so evidence does not depend on one project coordinator.
Practical implementation
Test responsibilities through a customer workflow.
Walk through a new project from contract approval to team allocation, access provision, delivery and closure. Include temporary staff, elevated access and customer-provided tools. The review should reveal where approvals happen and whether evidence can be obtained without interrupting delivery.
Agree the implementation sequence with the people who own release schedules, staffing and infrastructure. Estimate effort after assessing the current position. Keep consulting support, client implementation work, tools and certification-body fees visible as separate components of the proposal.
Illustrative operating decisions
Two Indian delivery situations.
Hypothetical examples, not client case studies or claims of completed engagements.
A Bengaluru capability centre supports a group platform
A hypothetical Bengaluru engineering team supports a platform owned by an overseas parent. The parent manages the production identity system, but local managers approve staff assignments and emergency support. The scope exercise identifies who can provide reliable access and change evidence.
The agreed workflow connects local approval with group provisioning and customer-impact escalation. Internal review follows a real staff move and a production issue to check that responsibilities work across time zones, rather than relying solely on headquarters policy.
A Pune software provider opens a second delivery team
A hypothetical Pune company adds a team for a new enterprise customer. Developers use a mix of corporate systems and customer-hosted repositories. The project must determine which instructions, approvals and records belong to each environment.
The implementation pack gives staff a clear route for access requests, test-data questions and security incidents. The evidence index distinguishes company-operated controls from customer confirmations, avoiding a misleading claim that the provider administers the entire stack.
Our service commitment
100% successful ISO certification guaranteed.
Our guarantee applies to the agreed ISO certification engagement. Confirm its scope and terms in your proposal. The independent certification body conducts the audit and makes the certification decision.
Agree the services, locations and legal entity covered by the certification engagement. Ensure the operating teams can explain their controls and retrieve evidence, and allow time to close findings before the independent assessment.
Before you commission the work
Resolve the delivery boundary early.
Can a global capability centre have its own scope?
A local scope can be considered if its activities and dependencies are clearly described. Clarify headquarters controls, local authority and the evidence available before agreeing the certification arrangement.
Do customer-managed tools fall outside the work?
They remain relevant where your staff use them or depend on them. Record retained responsibilities and the limits of your access or control instead of excluding the whole workflow automatically.
Does ISO 27001 certify legal compliance with the DPDP framework?
No automatic legal-compliance conclusion follows. Keep applicable duties and dates separately assessed, and use relevant security evidence to support that work.
Can we include several delivery locations?
Identify the intended locations and how controls operate at each. Agree scope, evidence coverage and the assessment arrangement before promising multi-site coverage.
How can we reduce disruption to delivery?
Use existing workflow records where they are suitable, assign clear owners and schedule practical reviews around delivery constraints. Unresolved controls still need implementation and evidence.
What information is needed for a proposal?
Share the services, delivery entities, locations, customer assurance request and current controls. High-level diagrams and responsibility summaries are useful; do not send production credentials or customer datasets.
Reference basis
Sources and scope of this guidance
ISO: ISO/IEC 27001:2022 overview; MeitY: Digital Personal Data Protection Act, 2023 and Rules, 2025; ISO: independent certification.
Official references checked 13 October 2026. The implementation examples are practical recommendations; legal applicability and the agreed certification scope need their own review.
Plan the engagement
Turn the customer requirement into a workable programme.
Tell us what your Indian operation delivers, which controls it owns and when the assurance outcome is needed. We can define the scope, outputs and responsibilities for the next stage.