Question 1

What is GRC and why does it matter?

Accepted Answer

GRC stands for Governance, Risk, and Compliance. It is the practice of aligning security controls, risk management, privacy obligations, and regulatory requirements so your organization can operate with confidence. A structured program helps you pass audits, win customer trust, and reduce incidents — without relying on spreadsheets and email threads.

Question 2

How do ComplAI, PrivyCore, TPRM, and ASM work together?

Accepted Answer

Propel Ready Solutions delivers six integrated platforms: ComplAI for GRC and compliance, PrivyCore for India DPDP and privacy operations, TPRM for continuous third-party risk, ASM for outside-in attack surface management with 20 capability modules, VAPT as a Service for managed penetration testing, and Red Teaming as a Service for adversary simulation — all inside ComplAI Assurance where security, privacy, and audit programs overlap.

Question 3

What is the difference between SOC 2 and ISO 27001?

Accepted Answer

SOC 2 is a US-focused attestation report based on the AICPA Trust Services Criteria, commonly requested by SaaS buyers. ISO 27001 is an international certification standard for an Information Security Management System (ISMS). Many companies pursue both: SOC 2 for sales velocity in North America, and ISO 27001 for global certification and structured ISMS maturity.

Question 4

How do I request a demo or speak with Propel Ready Solutions?

Accepted Answer

Visit our Company page and open the contact form with your name, phone, email, and requirements. Our team will respond to discuss ComplAI, PrivyCore, TPRM, ASM, GRC advisory, and the frameworks relevant to your business.

Question 5

What is India DPDP?

Accepted Answer

India DPDP refers to the Digital Personal Data Protection Act, 2023 — India’s central law for how organizations collect, process, store, and transfer digital personal data. It defines roles such as Data Fiduciary and Data Processor, sets lawful processing and notice requirements, grants rights to individuals (called Data Principals), and establishes the Data Protection Board of India for enforcement. The DPDP Rules 2025, notified in November 2025, provide the operational detail and phased compliance deadlines.

Question 6

Who must comply with India DPDP?

Accepted Answer

The Act applies to any organization processing digital personal data in India, and to processing outside India when it involves offering goods or services to individuals in India. If you collect customer, employee, vendor, or user data through websites, apps, CRM, HRMS, loyalty programs, or marketing channels, you likely act as a Data Fiduciary or Data Processor and must comply — regardless of sector.

Question 7

What personal data is protected under DPDP?

Accepted Answer

Digital personal data about an identifiable individual is protected — including name, phone number, email, government identifiers, location, online identifiers, financial and health information, employment records, and behavioural data linked to a person. It covers data collected through websites, mobile apps, POS systems, call centres, WhatsApp, email, and integrated SaaS tools.

Question 8

What are the main obligations under India DPDP?

Accepted Answer

Organizations must process data lawfully with clear notice, obtain verifiable consent where required, use data only for stated purposes, implement reasonable security safeguards, honour data principal rights (access, correction, erasure, grievance), maintain processing records (RoPA), manage processor contracts, notify breaches when required, and erase data when purpose is fulfilled or consent is withdrawn — unless a valid legal basis to retain exists.

Question 9

What is the India DPDP compliance timeline?

Accepted Answer

Compliance rolls out in phases under the DPDP Rules 2025: foundation and enforcement machinery from 13 November 2025; consent infrastructure and registered Consent Managers by 13 November 2026; and full substantive obligations — including scaled notice, consent, security, breach, and rights workflows — by 13 May 2027. Early readiness reduces penalty exposure and audit disruption.

Question 10

What are consent requirements under India DPDP?

Accepted Answer

Consent must be free, specific, informed, and unambiguous, with clear notice before or at the time of collection. Withdrawal must be as easy as giving consent. Certain uses — such as some marketing, profiling, or transfers — require explicit, verifiable consent records. Consent Managers registered with the Data Protection Board will support traceability for many organizations from November 2026 onward.

Question 11

What rights do data principals have under DPDP?

Accepted Answer

Data Principals can request access to their personal data, correction of inaccurate data, erasure when consent is withdrawn or purpose is fulfilled, and nomination of another person to exercise rights on their behalf. They also have a grievance redressal path through the Data Fiduciary and, if unresolved, through the Data Protection Board. Organizations need intake, verification, SLA tracking, and evidence for each request.

Question 12

What are breach notification requirements under DPDP?

Accepted Answer

When a personal data breach occurs, Data Fiduciaries must take prompt steps to mitigate harm and notify affected Data Principals and the Data Protection Board as required by the Rules. Programs should define severity thresholds, escalation paths, regulator-ready timelines, and documented evidence — not ad-hoc email chains when an incident happens.

Question 13

What is a Significant Data Fiduciary (SDF)?

Accepted Answer

The government may designate certain Data Fiduciaries as Significant Data Fiduciaries based on volume, sensitivity, risk to rights, or public interest. SDFs face additional obligations such as appointing a Data Protection Officer, conducting Data Protection Impact Assessments (DPIA), periodic independent audits, and enhanced accountability measures. PrivyCore supports DPIA workflows and audit-ready evidence for SDF-grade programs.

Question 14

How does PrivyCore help with India DPDP compliance?

Accepted Answer

PrivyCore operationalizes DPDP through gap assessment, consent and notice management, RoPA and Auto-Discovery, DSAR and grievance workflows, breach response tracking, DPIA automation, processor oversight, and an evidence briefcase for regulators and auditors — mapped to the phased DPDP Rules 2025 rollout so teams know what to do before each deadline.

Question 15

What is ComplAI?

Accepted Answer

ComplAI is Propel Ready’s AI-powered GRC platform. It brings together multi-framework controls, ISMS policy templates, approval workflows, control evidence, risk registers, ComplAI Intelligence, integrations, and leadership dashboards in one workspace — so teams stay continuously audit-ready.

Question 16

Which frameworks does ComplAI support?

Accepted Answer

ComplAI supports SOC 2, ISO 27001, GDPR, HIPAA, PCI DSS, India DPDP, SEBI CSCRF, ISO 27701, ISO 22301, and more — with pre-mapped controls and reusable evidence across overlapping certifications.

Question 17

How long does SOC 2 Type II typically take?

Accepted Answer

Most organizations need 3–6 months to prepare for a first SOC 2 Type II audit, including a minimum observation period (often 3–12 months depending on scope). ComplAI helps accelerate readiness with pre-mapped controls, policy templates, and evidence tracking.

Question 18

How do you get ISO 27001 certified with ComplAI?

Accepted Answer

ISO 27001 certification requires establishing an ISMS, conducting a risk assessment, implementing Annex A controls, running internal audits, and passing a two-stage external audit. ComplAI provides ISO 27001-mapped controls and 100+ Annex A-aligned ISMS policy and procedure templates to support each stage.

Question 19

How do policy approval workflows work in ComplAI?

Accepted Answer

ComplAI supports configurable approval matrices with prepare and review steps. Authors prepare and submit policy versions; designated reviewers approve or reject in sequence. Each employee has a My Approvals inbox for pending actions, with progress tracking and document review built in.

Question 20

Can ComplAI connect to our HRMS, IAM, and SIEM tools?

Accepted Answer

Yes. ComplAI includes an integrations catalog covering HRMS, IDAM, SIEM, VAPT, and SSO vendors — with step-by-step setup guides for 80+ tools, covering deployment models and capability mapping for automated evidence collection.

Question 21

What is ComplAI Intelligence?

Accepted Answer

ComplAI Intelligence is the AI copilot built into ComplAI — for gap analysis, questionnaire autofill, SecOps context, and remediation guidance. It helps GRC teams move faster without losing auditor-ready rigor.

Question 22

What is PrivyCore?

Accepted Answer

PrivyCore is Propel Ready’s dedicated data privacy platform for India DPDP and mature privacy governance. It covers consent, notices, RoPA, Auto-Discovery, DSAR, grievance, breach response, DPIA, processor oversight, and auditor-ready evidence in one DPDP-ready workspace.

Question 23

How does PrivyCore support India DPDP?

Accepted Answer

PrivyCore maps to India DPDP through four capability centers — Govern, Identify, Control, and Communicate — covering sixteen program modules. Teams get gap assessment, control templates, consent and notice workflows, data principal rights, breach notification tracking, and evidence briefcase exports for regulators and auditors.

Question 24

What is Auto-Discovery and how does it relate to RoPA?

Accepted Answer

Auto-Discovery scans databases, file shares, and SaaS applications for personal data patterns, classifies findings, and reconciles them to your Records of Processing Activities (RoPA). That keeps your data inventory current instead of relying on one-time spreadsheets before every review.

Question 25

How are DSAR and grievance requests handled?

Accepted Answer

PrivyCore provides a rights center for intake, identity verification, SLA tracking, and fulfillment workflows — aligned to DPDP timelines for access, correction, erasure, portability, and grievance redressal — with an audit trail and evidence for each request.

Question 26

How does PrivyCore connect to ComplAI and TPRM?

Accepted Answer

PrivyCore integrates with ComplAI for security GRC where privacy and security programs intersect, with ComplAI TPRM for processor and vendor assessments, and with ComplAI ASM where internet-facing exposure and vendor attack-surface data should align. Processor registers, DPA tracking, vendor risk, and external posture can stay connected for DPOs, security teams, and auditors.

Question 27

Does PrivyCore support frameworks beyond India DPDP?

Accepted Answer

Yes. PrivyCore is built for India DPDP first, with mapping to GDPR and ISO 27701 privacy controls — so global organizations can run India-specific operations while maintaining alignment with broader privacy programs.

Question 28

What is ComplAI TPRM?

Accepted Answer

ComplAI TPRM is the third-party risk domain inside ComplAI. Security and procurement teams get vendor portfolio management, 0–950 security ratings, live external intelligence, framework questionnaires, findings and remediation, and audit-ready Word and Excel exports — mapped to ISO A.5.19 and SOC 2 vendor management.

Question 29

How do vendor security ratings work?

Accepted Answer

Each vendor receives an aggregate security score on a 0–950 scale with grade bands, based on attack-surface vectors, breach history, credential exposure, and correlated external intelligence. Ratings update as live signals change — replacing point-in-time spreadsheet reviews.

Question 30

What are instant risk reports?

Accepted Answer

Instant reports run live external scans (including sources like Censys, VirusTotal, NVD, and HIBP) against a vendor domain and deliver a point-in-time assessment in under 60 seconds — with findings, evidence counts, and an executive narrative ready for procurement or audit committee review.

Question 31

What is industry baseline benchmarking?

Accepted Answer

Industry baseline compares each vendor to sector peers with percentile rank, sector average, and domain-level deltas — so teams know whether a vendor is above or below what is typical for fintech, SaaS, healthcare, and other sectors before contract renewals.

Question 32

Does TPRM support framework questionnaires and AI autofill?

Accepted Answer

Yes. TPRM includes framework-mapped vendor questionnaires (including ISO A.5.19 and SOC 2 vendor management themes) with AI-assisted autofill from prior assessments and external intelligence, plus assessor review workflows and reusable templates per vendor tier.

Question 33

Can TPRM reports support audit committees and vendor reviews?

Accepted Answer

TPRM exports instant and portfolio reports to Word and Excel — with ratings, findings, remediation status, and executive summaries — so leadership, procurement, and auditors get a clear third-party risk narrative without manual report assembly.

Question 34

What is ComplAI ASM?

Accepted Answer

ComplAI ASM is the attack surface management domain inside ComplAI. Security teams get continuous outside-in discovery across 20 capability modules, light scans in minutes, deep scan campaigns for subdomain and port discovery, 800+ exposure rules, CVE and EPSS prioritization, shadow IT and cloud ASM, issues with SLA tracking, bulk remediation, and a 0–950 posture score on the leadership dashboard — linked to your GRC program.

Question 35

What ASM capability modules are included?

Accepted Answer

ASM includes eight core modules — Discovery, Shadow IT, Prioritization, Monitoring, Expander, Attribution, Cloud ASM, and Response — plus twelve solution workspaces: Attack Paths, Threat Exposure, Secret Exposure, Credential Intel, Web/API Scan, DNS Takeover, Posture Trends, Compliance Risk, Due Diligence, Cyber Insurance, Portfolio Risk, and Vendor Exposure.

Question 36

How does outside-in asset discovery work?

Accepted Answer

ASM discovers internet-facing domains, subdomains, IPs, services, certificates, and cloud assets without deploying agents on every host. Passive and active techniques, seed-domain expansion, and enrichment from sources such as Shodan, Censys, and BitSight keep inventory current as your surface changes.

Question 37

How are ASM findings prioritized?

Accepted Answer

Exposures are ranked using CVE and EPSS exploit probability, CVSS severity, asset criticality, and business context — so teams focus on internet-reachable paths attackers would exploit first, not just the noisiest scanner output.

Question 38

Does ASM appear on the leadership dashboard?

Accepted Answer

Yes. ASM posture score, open exposures, critical findings, and asset counts feed the ComplAI leadership dashboard alongside framework readiness and vendor risk — giving CISOs and CIOs one executive view of outside-in exposure.

Question 39

How does ASM connect to ComplAI GRC and TPRM?

Accepted Answer

ASM runs inside ComplAI and links remediation cases to your control and risk program. Vendor attack-surface vectors also correlate with ComplAI TPRM ratings, so third-party risk and your own internet footprint stay connected for security operations and audit narratives.

Question 40

What is the difference between light scan and deep scan?

Accepted Answer

Light scan refreshes outside-in intelligence in about one to two minutes using seed domains and enrichment providers. Deep scan runs a multi-phase campaign — subdomain enumeration, host resolution, port scanning, and finding merge — for thorough discovery when you need expanded inventory beyond the daily light refresh.

Question 41

What is ComplAI VAPT as a Service?

Accepted Answer

VAPT as a Service is Propel Ready’s managed penetration testing offering inside ComplAI Assurance. Engagements follow a seven-phase workflow — scope, plan, automated VA, manual pentest, live findings tracker, formal report, and retest — with client-side scanning at your network edge and findings mapped to your GRC controls.

Question 42

How does client-side automated VA work?

Accepted Answer

Automated vulnerability assessment runs from a ComplAI scan runner at your network edge using tools such as Tenable, Nessus, and Qualys. Scan results sync into the live finding register without shipping raw scan data off-site — keeping breadth-first CVE and hygiene coverage inside your environment.

Question 43

Why a live findings tracker instead of a final PDF?

Accepted Answer

Critical findings surface in real time during active testing so developers can patch on day one. Owners get severity, reproduction steps, and Jira or ServiceNow tickets immediately — instead of waiting weeks for a static report after the test window closes.

Question 44

How does VAPT connect to ComplAI Assurance and ASM?

Accepted Answer

VAPT engagements live alongside SAST, DAST, infra, and cloud findings in ComplAI Assurance. Open vulnerabilities feed the leadership dashboard, and teams can combine managed VAPT with ComplAI ASM outside-in monitoring for defense-in-depth visibility.

Question 45

When should we use VAPT as a Service?

Accepted Answer

Common drivers include ISO 27001 and SOC 2 annual penetration tests, PCI-DSS assessments, pre-release security gates, M&A diligence on acquired platforms, and complementing continuous ASM with point-in-time manual exploitation of business-logic flaws automated scanners miss.

Question 46

What is ComplAI Red Teaming as a Service?

Accepted Answer

Red Teaming as a Service is Propel Ready’s managed adversary simulation offering inside ComplAI Assurance. Engagements follow a nine-phase workflow — objectives, threat model, recon, initial access, manual attack simulation, lateral movement, crown-jewel validation, purple-team workshops, and executive debrief — with operator-led TTPs mapped to MITRE ATT&CK and your GRC controls.

Question 47

What is manual attack simulation in a red team engagement?

Accepted Answer

Manual attack simulation is hands-on, operator-led exploitation during the red team exercise — chained exploit paths, custom payloads, business-logic and API abuse, and live pivoting that automated VA tools miss. Propel Ready operators document each step with PoC evidence for purple-team replay and Assurance tracking, always within signed rules of engagement.

Question 48

How is red teaming different from VAPT as a Service?

Accepted Answer

VAPT focuses on scoped penetration testing with live findings and retest close-out. Red teaming emulates a real adversary against crown-jewel objectives — often combining social engineering, lateral movement, and purple-team detection tuning. Many programs run both: ASM recon, VAPT for depth, and red team for resilience validation.

Question 49

What are purple-team workshops?

Accepted Answer

Purple-team sessions pair Propel Ready red operators with your SOC analysts — replaying TTPs in real time, tuning SIEM detections, and validating SOAR playbooks while the exercise is still active, instead of waiting for a static report.

Question 50

How does red teaming use ComplAI ASM?

Accepted Answer

Reconnaissance phases consume ComplAI ASM outside-in intelligence — exposed services, shadow IT, and credential context — so kill chains start from the same exposure data your continuous monitoring program already tracks.

Question 51

When should we use Red Teaming as a Service?

Accepted Answer

Common drivers include RBI and ISO cyber resilience exercises, pre-incident SOC validation, board-ready ATT&CK heatmaps, M&A assurance, and pairing annual red team with VAPT retest cycles for defense in depth.

Frequently asked questions

Still have questions?