Cybersecurity and compliance, handled.
One accountable team for cybersecurity and compliance: PCI DSS, ISO/IEC 27001, penetration testing, risk assessments, data protection, and security governance. We do the work and hand you artifacts a real auditor can sign, not a dashboard full of green checkmarks.
Cyber & IT
Governance
Offensive
Data
PCI
ISO/IECCredentials held by our team
One team across every security and compliance discipline.
Most regulated businesses juggle a PCI consultant, a pen-test vendor, an ISO advisor, a privacy lawyer, and a freelance DPO. We bring those disciplines under one accountable team, so your whole cybersecurity compliance program connects and nothing falls through the gaps.
Offensive Security
Penetration testing and red teaming against real cyber threats, producing evidence and fixes, not noise.
- Network, web & cloud pen testing
- Red team & adversary simulation
- Vulnerability assessment & retest
Data Protection
GDPR and HIPAA readiness, plus a named DPO when the engagement calls for one.
- GDPR readiness & Article 28 support
- HIPAA readiness & BAA chain
- DPO as a service
PCI Services
PCI DSS v4.0.1 for merchants and service providers, from self-assessment to a QSA-signed Report on Compliance.
- PCI DSS gap analysis & readiness
- SAQ support & ASV scanning
- QSA-signed ROC / AOC via partners
ISO/IEC Certification
ISO/IEC 27001, 27701, 22301 and 20000-1, certified through IAF-accredited partners.
- ISO/IEC 27001:2022 certification
- ISO/IEC 27701 privacy extension
- Gap analysis & Stage 1/2 support
Cybersecurity & IT
Managed security, hardening, and the IT controls auditors expect to see.
- Security hardening & configuration
- Managed detection & response
- Cloud & network security
Governance & Frameworks
SOC 2, the NIST cybersecurity framework, CIS, and vCISO leadership to keep your security program on cadence.
- SOC 2 Type I & II readiness
- NIST & CIS maturity assessments
- vCISO & security governance
What sets us apart.
Named delivery
One named lead and a single point of contact from scope call to sign-off, plus a named DPO where the engagement requires one. You always know who owns the work and who to call.
Accredited where it counts
QSA-signed PCI reports, IAF-accredited ISO certificates, CREST-aligned testing, and CPA-issued SOC 2, through accredited partners. We are clear about who signs what.
Artifacts, not dashboards
You receive evidence an auditor can act on: signed policies, completed assessments, test reports, attestations. Not a screen of green checkmarks.
Calm, not fear
Every engagement opens with a defined scope, a quote against that scope, and a plan that states what is ours and what is yours. No breach statistics, no countdown clocks, no scope creep.
A named lead on every engagement.
Onyx Security Labs is led by a credentialed practitioner, not a sales desk. You work directly with the person accountable for delivery.
Atika leads security service delivery and the methodology behind PCI, HIPAA, GDPR, ISO 27001, and SOC 2 readiness engagements. She is also a cybersecurity instructor, teaching the same standards she delivers against. Every engagement runs through her credentialed team, with a named lead and a single point of contact from scope call to sign-off.
Built on the standards your auditors expect.
One credentialed team across PCI, ISO, SOC 2, GDPR, HIPAA, NIST, and CIS, aligning your regulatory compliance and security controls across every framework you answer to.
From scope call to delivered.
Book a scope call
A 30-minute call to confirm what you need, what is in scope, and the timeline. No sales pitch.
Proposal & scope
We send a Statement of Work tailored to your scope, with a quote against the work you confirmed.
Delivery
Named team assigned, kickoff within days. We author documentation, run assessments, and guide remediation.
Maintained
We keep your security posture current between audits and certification cycles with continuous monitoring, so you stay audit-ready and compliant.
Tell us what you are facing. We will map it to the right work.
One regulator or several. We work across compliance frameworks, so a single team can carry PCI, ISO, SOC 2, GDPR, and HIPAA, plus risk assessments and security governance, at once.
- Before the call. A few quick questions: which services, your headcount, your timeline.
- On the call. We confirm scope, frameworks, and what is in versus out. 30 minutes, no pressure.
- Same day. A Statement of Work and quote against exactly what you confirmed.
Prefer email? Write us at [email protected] and we will reply within one business day.
Thanks, we have it.
Email [email protected] and we will reply within one business day.
How ready is your security and compliance?
Answer 15 quick questions across the controls auditors actually check, and get an instant readiness score with tailored next steps. No call required.
Ready to simplify security and compliance?
Pick a service, book a scope call, or ask a question. Whatever order works.