Loading page…
About
Dabster Group advises organisations on cybersecurity, governance, risk, compliance and data governance. SecureGRC exists because our engagements kept ending the same way — a sound framework handed to a team with nowhere to run it.
Who we are
Dabster Group is a brand of ExpertGRC Consulting Services Private Limited, a management consulting firm specialising in ISO and cyber auditing. The work spans process optimisation, technology and organisational improvement — which in practice means we are usually brought in when a compliance obligation has exposed something structural about how an organisation operates.
Our leadership comes from business process improvement, ISO standards and cybersecurity. That combination is deliberate: a management system designed by auditors alone tends to be unworkable, and one designed by engineers alone tends to be uncertifiable.
We operate from New Delhi and deliver engagements internationally. Where a client needs both an advisory partner and a system to run the programme in, we can provide both — and where they only need one, we are equally comfortable with that.
Dabster Group at a glance
Registered entity
ExpertGRC Consulting Services Private Limited
Shop No. 42, Block-C, Janak Puri, New Delhi – 110058, India
To help organisations achieve operational excellence through consulting that improves how they actually work — specialising in ISO and cyber auditing, and focused on process, technology and organisational improvement rather than documentation for its own sake.
To be the partner organisations trust with the work that has to hold up under scrutiny — a consultancy whose frameworks survive the audit, the reorganisation and the year after the engagement ends.
Our commitment
A successful engagement leaves the capability inside your organisation
How we work
Principles are easy to publish and hard to demonstrate. Here is what each one commits us to.
Scope follows the outcome you need to demonstrate. We would rather deliver a smaller engagement that solves the problem than a larger one that fills a proposal.
Deliverables are reviewed internally before they reach you, and every conclusion traces back to evidence we can produce on request.
If a control is not working, the report says so. If a timeline is not achievable, we say that at scoping rather than at delivery.
We work alongside your team and hand over capability. The measure of a good engagement is that you need us less afterwards.
Delivery philosophy
These are commitments about how work is carried out, and they are the things we will not trade away to shorten a timeline.
The people who scope an engagement are the people who deliver it. There is no handover from the person you met to a team you have not.
Each phase produces an output you can read, challenge and approve before the next one begins. Nothing depends on trusting that earlier work went well.
Where we implement, a separate team audits, and the separation is documented — so a certification body or audit committee can rely on the result.
If the work required is narrower than anticipated, we say so and rescope. A larger engagement that does not solve the problem serves neither side.
Engagements end with your team trained and a full cycle run alongside them. The measure of good work is that you need us less afterwards.
Framework design does not assume our technology. We implement into whatever system you run, and no licence commitment is bundled into consulting scope.
Expertise
Six practices, staffed by consultants, auditors and assessors who work across them rather than in silos.
Risk frameworks, regulatory obligations and a GRC operating model your board can actually govern from.
ISO 27001, 27701, 27017, 20000-1, 9001, 22301, 14001, 45001 and 37001 — from gap analysis to certification and beyond.
Vulnerability assessment, penetration testing, configuration review, web application testing and source code review.
Internal audit, control testing, compliance evaluation and operational reviews against recognised standards.
Ownership and stewardship, classification, data quality and lifecycle — with privacy obligations built in from the start.
Practical security, privacy and compliance training that changes how teams work — not annual slide decks.
Our technology
SecureGRC is not a partner product we resell. Dabster Group builds, maintains and supports it — a multi-tenant enterprise GRC platform covering governance, policy, compliance, unified controls, risk, third-party risk, continuity, audit, access reviews, training and reporting.
That ownership is what makes the consulting different. When we design a control framework, we can implement it directly into a system we control, and when a client needs the platform to reflect how their programme actually works, there is no vendor in between.
Work with us
Tell us what has to be demonstrated, to whom, and by when. You will get a candid assessment of what the work requires — and whether this is the right firm to carry it out.