Skip to main content
Threatsys

Cyber Security Audit & Review

STQC Audit & GIGW Compliance

STQC cyber security audit and GIGW certification for government digital services.

Every engagement includes manual validation, a two audience report and free re-testing.

Get a scoped quote+91 96682 00222

What this actually is

STQC audit and GIGW compliance are what stand between a government digital service and going live. GIGW covers how a government website must be built, from accessibility and language support to content policy and security.

Departments usually discover the requirements late, after the build is finished, which turns a manageable checklist into a rebuild. Getting in early costs a fraction of that.

We assess against both the STQC scheme and the GIGW guidelines, fix what would fail, and support the formal evaluation.

What we go after

  • GIGW conformance across content, design and accessibility
  • STQC security audit of the application and infrastructure
  • Multilingual and Unicode support verification
  • Accessibility to WCAG level as GIGW requires
  • Content management and update workflow
  • Hosting, domain and certificate compliance
  • Data protection and citizen privacy

How we run it

  1. 01

    Understand the business

    What you do, what would genuinely hurt if it stopped, and how much risk your board will carry.

  2. 02

    Assess

    People, process and technology together, because attackers do not respect the boundary between them.

  3. 03

    Benchmark and rank

    Where you sit against your peers and your regulator, with findings ranked by real exposure.

  4. 04

    Roadmap

    A sequenced plan with costs attached, so the business case writes itself.

What you receive

  • GIGW conformance report against each guideline
  • STQC security audit report
  • Remediation plan before formal evaluation
  • Certification support

Who needs this

Central and state government departments, public sector undertakings, and the vendors building their citizen-facing services.

How long it takes

Six to twelve weeks including evaluation support.

Standards this satisfies

  • GIGW
  • STQC
  • WCAG 2.1
  • CERT-In

Why it matters

There is a gap between knowing you have a security problem and knowing which one to solve first. Advisory work exists to close that gap: an independent view of where the risk actually sits, expressed in terms a board can act on and a budget can be built around.

The other reason is availability. Most organisations do not need a full time security leader, but they do need someone to ask before making a decision rather than after. The cost of the wrong architecture choice, or the wrong vendor, dwarfs the cost of the conversation that would have prevented it.

Choose how you want this delivered

Most of the price difference between quotes comes down to this one choice, and it is rarely explained. Pick one to see what it covers, what it suits and what it costs you.

A defined number of days a month with a named advisor who keeps context between conversations. This is what most organisations actually need: not a large project, but someone to ask before making a decision rather than after.

Choose this when

  • Decisions arriving faster than you can hire for
  • You need continuity rather than another report
  • Board or committee reporting on a regular cycle

Effort and cost

Monthly, with a defined day allocation. Far cheaper than a hire and available immediately.

Scope it yourself, before you call anyone

Answer a few questions and you get an indicative number, the working behind it and what your answers tell us. It runs in your browser, so nothing you type reaches us.

1/5

Which framework are you going for?

What we look for, and keep finding

These are the classes of problem this work exists to surface. Not every engagement finds all of them, but these are the ones that turn up often enough to be worth naming.

  • Capability that does not match the risk

    Heavy investment in one area and nothing in another, usually reflecting what a previous incident or a previous hire cared about rather than where the current exposure sits.

  • No owner for the important things

    Ask who owns third party risk, or identity, and the answer is a committee. Controls without a named owner degrade quietly and predictably.

  • Reporting that does not support a decision

    Dashboards full of counts that never answer the question a board actually asks, which is whether we are more or less exposed than last quarter and what it would cost to change that.

  • Unmanaged supplier concentration

    Several critical services resting on one provider, with no assessment of what happens if it becomes unavailable or compromised.

  • Plans that have never been tested

    Incident response and continuity documents that read well and have never been rehearsed. The first rehearsal always finds something, which is the point of having one.

Who runs your engagement

A practitioner, not a presentation

Advisory work is led by someone who has run security operations rather than only advised on them. The test we apply to our own recommendations is whether the person making them has had to live with a decision like it.

Questions we get asked

Our portal is already live. Is it too late?

No, but it will cost more than it would have. We prioritise anything that blocks certification first and treat the rest as a backlog.

Often scoped alongside

Ready to scope your stqc audit & gigw compliance?

Thirty minutes with a senior engineer, and you leave with a written scope and indicative effort.

Book a 30-min consultation+91 96682 00222