Pallavex
Cybersecurity consultancy · Compliance advisory

Security and compliance you can explain to your board.

Pallavex helps growing companies in Singapore and across APAC decide what to protect first, build a security programme that fits their size, and get ready for ISO/IEC 27001, SOC 2 and PDPA obligations.

Start a conversation See what we do

Two things, done properly

We focus on advice and written work you can act on. We do not resell software, and every engagement ends with documents your team owns.

01

Cybersecurity consultancy

For leadership teams who need a clear view of their security position and a realistic plan to improve it.

  • Security strategy and roadmapA prioritised 12–24 month plan tied to business goals, budget and headcount.
  • Risk assessmentA risk register covering your key systems, data and suppliers, with owners and treatment options.
  • Architecture and design reviewWritten findings on cloud, network and application designs, ranked by impact and effort to fix.
  • Security programme and vCISO-style advisoryOngoing senior guidance: steering meetings, board reporting and decisions on tools and vendors.
  • Incident-readiness planningAn incident response plan, roles and contact lists, and a tabletop exercise to test it.
02

Compliance and advisory

For companies facing a customer questionnaire, a certification target or a regulatory obligation.

  • ISO/IEC 27001 readinessScope definition, statement of applicability, ISMS documentation and support up to the certification audit.
  • SOC 2 readinessControl mapping against the Trust Services Criteria, evidence planning and auditor coordination.
  • Singapore PDPA and data protectionData inventory, policies, breach-notification process and guidance on DPO responsibilities.
  • Policy and procedure writingPlain-language policies that match how your company actually works, not boilerplate.
  • Audit preparation and gap analysisA gap report against your chosen standard, with a remediation plan and timeline.

How an engagement works

Every engagement follows the same four steps. You can stop after any of them and keep everything produced so far.

  1. Discovery

    A short call to understand your business, what is driving the work and what a good outcome looks like. We agree scope and fees in writing.

  2. Assessment

    Interviews, document review and technical walkthroughs to establish where you stand today against your goals or chosen standard.

  3. Roadmap

    A written report and prioritised plan: what to fix, in what order, who owns it and roughly what it will cost.

  4. Support

    Optional ongoing help to deliver the plan — advisory hours, document drafting, audit support or a regular vCISO-style check-in.

Why Pallavex

  • Independent advice

    We do not sell products or take referral fees, so our recommendations are about your risk, not our margin.

  • Sized for SMEs and mid-size firms

    Controls and documents scaled to your team, not copied from a large-enterprise template.

  • Written, owned deliverables

    Every engagement produces documents your team keeps and can maintain without us.

  • Local context

    Advice that accounts for Singapore and regional requirements such as the PDPA alongside international standards.

Questions we are often asked

Are you a certification body or auditor?

No. We help you prepare for ISO/IEC 27001 certification or a SOC 2 examination. The certification audit or SOC 2 report itself must be issued by an accredited certification body or a licensed audit firm, which you appoint separately. Keeping these roles separate is what keeps the result credible.

How long does ISO/IEC 27001 or SOC 2 readiness take?

It depends on your size, scope and how much is already in place. After the assessment step we give you a written estimate based on your actual gaps rather than a generic figure.

We are a small company. Is this for us?

Yes. Many smaller firms come to us because a customer has sent a security questionnaire or asked for a certification. We scope the work to what you need to answer that request well.

Do you do penetration testing or managed security?

Not directly. Our work is consultancy and compliance advisory. If you need testing or a managed service, we can help you write the requirements and evaluate providers independently.

How are engagements priced?

Assessments and readiness projects are usually quoted as a fixed fee after discovery. Ongoing advisory is typically a monthly retainer for an agreed number of hours.

How do you handle our confidential information?

We are happy to sign a mutual NDA before discovery, we only request the information needed for the agreed scope, and we return or delete it when the engagement ends.

Talk to us

Tell us briefly what prompted you to get in touch. We will reply to arrange a short discovery call.

  • Your company and industry
  • What you need — a plan, a certification, a policy set, or advice
  • Any deadline, such as a customer or audit date
hello@pallavex.freiz.space Email us