Skip to content
Sam&Co

Compliance · Audit · Certification

Navigate regulation with confidence.

Expert consulting and certification support across the global standards your customers, regulators and partners expect.

Request a gap assessment

Frameworks

The standards we certify against.

Many controls overlap. We map them once and reuse the evidence, so adding a second framework costs a fraction of the first.

PCI DSS

Payment Card Industry Data Security Standard

For any business that stores, processes or transmits cardholder data. We scope your cardholder data environment tightly, then close the gaps against PCI DSS v4.0.1.

  • Scope reduction and segmentation
  • Cardholder data protection
  • SAQ and RoC preparation
  • QSA audit support

HIPAA

Health Insurance Portability and Accountability Act

For healthcare providers and vendors handling US patient data. We implement the safeguards the Security and Privacy Rules require and the evidence to prove it.

  • PHI data mapping
  • Access controls and audit trails
  • Risk analysis
  • Business Associate readiness

GDPR

EU General Data Protection Regulation

For organisations serving people in the EU. We embed privacy by design into your systems and processes, not just your policies.

  • Records of processing
  • Consent and lawful basis management
  • DPIAs
  • Data subject request workflows

CCPA / CPRA

California Consumer Privacy Act

For businesses handling personal information of California residents. We build the notices, opt-outs and request handling the law expects.

  • Consumer rights handling
  • Opt-out and 'Do Not Sell or Share'
  • Privacy notice review
  • Vendor contract review

ISO Standards

ISO/IEC 27001 · ISO 9001 · ISO 22301

Information security, quality and business continuity management systems — designed to fit how you already work, and to pass certification audits.

  • ISMS / QMS / BCMS design
  • Statement of Applicability
  • Internal audit
  • Certification body support

DPDP Act

India's Digital Personal Data Protection Act, 2023

For organisations processing personal data in India. We help you map obligations as a Data Fiduciary and build consent, notice and grievance processes.

  • Personal data inventory
  • Consent and notice design
  • Grievance redressal process
  • Children's data safeguards

Our compliance process

Four steps from gap to certificate.

  1. 01

    Assess

    Current-state analysis and gap identification against the target framework or architecture.

  2. 02

    Plan

    A prioritised roadmap with timelines, owners and effort — so you know what certification or delivery will take.

  3. 03

    Implement

    Controls, designs and documentation delivered alongside your team, not handed over the wall.

  4. 04

    Certify & sustain

    Audit support through to certification, then continuous monitoring and annual maintenance.

What you get

Compliance that survives the audit — and the year after.

  • A scoped, prioritised gap report — not a 200-page spreadsheet
  • Policies and procedures written for how your team actually works
  • Technical controls designed by architects, not just auditors
  • Evidence packs organised the way assessors ask for them
  • Support in the room during certification audits
  • Annual surveillance and recertification support

Not sure where you stand?

Start with a free 30-minute consultation. We'll tell you which frameworks apply to you and roughly what it will take to get there.

Book a free consultExplore services