Anyone holding personal data
Core PDPA obligations commence: security measures, records, DPO, breach notification.
Information security and compliance consultancy
ISO 27001 certification in 16 weeks, fixed fee.
From gap assessment to a passed Stage 2 audit, with one named consultant throughout. For Sri Lankan companies of 20 to 300 people.
- 16 weeks typical time to certificate
- Fixed fee agreed before work starts
- 93 controls Annex A, mapped to your evidence
- Stage 1 and 2 we sit in both audits with you
Standards and rules we work with
- ISO/IEC 27001:2022
- ISO 27701
- ISO 22301
- ISO 9001
- PDPA Sri Lanka
- CBSL and IRCSL directions
What we do
Five services. One way of working.
ISO 27001 implementation and certification readiness
From current state to a passed certification audit, with a fixed scope agreed before we start.
ISMS internal audit, surveillance support and maintenance
Independent internal audits, surveillance preparation and the 2013 to 2022 transition for companies that already hold ISO 27001.
Personal Data Protection Act readiness
Get ready for Sri Lanka’s PDPA, whose core obligations commence on 1 January 2027, and align the work with ISO 27001 so you do it once.
Business continuity and ISO 22301
Business impact analysis, continuity plans and exercises that prove the plans work. Certifiable to ISO 22301 if you need the certificate.
ISO 9001 quality management
A quality management system alongside your security programme, or on its own when tenders require the certificate.
Why now
Three deadlines are moving the market
Insurers
IRCSL requires a full-time CISO, ISO 27001-aligned incident reporting and an annual external audit.
Vendors to banks
CBSL requires accredited ISO 27001 from third parties touching bank data; a new outsourcing direction re-papers every contract.
How it works
First call to certificate in four steps
- 01
Scoping call
Week 0Forty-five minutes, then a fixed-fee proposal within a week.
- 02
Gap assessment
Weeks 1 to 2Where you stand against the standard, with a dated plan.
- 03
Build and train
Weeks 2 to 12Risk assessment, policies, controls and staff training.
- 04
Audit and certificate
Weeks 12 to 16Internal audit, then Stage 1 and Stage 2 with your chosen body.
Why n4sec
What you can hold us to
Fixed scope, fixed fee
The price and deliverables are in writing before we start.
Independent
We do not certify, sell software or take referral fees. You choose the certification body.
With you to the end
The engagement finishes when the certificate is issued, not when the documents are delivered.
Not sure where you stand? Start with a scoping call.
Forty-five minutes, no charge. We ask about your organisation, what is driving the project and what you already have in place, then send a written proposal with a fixed scope and fee.