Frequently Asked questions (FAQ)

Non-compliance to standards such as PCI DSS, PCI PIN, ISO/IEC 27001, or frames information security internationally recognizedmay expose you to:

🚨 Security breaches involving sensitive data

⚠️ Penalties, regulatory or contractual

🛑 Operational restrictions or loss of certifications

📉 Deterioration of the confidence of customers, partners, or purchasers

💰 Legal costs, reputational and operational incidents

Adopt these standards is not only an obligation technique, it is a strategic decision to protect your operation and ensure the continuity of the business.

IQ Information Quality is a signature colombian specialty exclusively on security in digital paymentswith more than 17 years of experience in Latin america and the Caribbean.
We are certified by the PCI SSC as:

✅ QSA (Qualified Security Assessor)

✅ QPA (Qualified PIN Assessor)

Us apart:

🧭 Unbiased approach: we do not sell technology or licenses

🌎 Regional experience: presence in multiple countries and regulatory environments

👥 Team internationally certified: QSA, QPA, CISA, CISSP, CISM

📢 Direct communication, and custom tracking

🔄 Tailored solutions the size, maturity and role of each customer

We accompany organizations in the standards compliance, PCI DSS and PCI PIN, with strategies adjusted to the operational context of each actor in the ecosystem of payments.

🔐 PCI DSS – the Protection of card data

We validate your controls to protect transactions face-to-face and non-face-to-face, in accordance with the requirements of the standard.

• GAP PCI DSS – We evaluate your current situation with priority focus in front of the PCI requirements
• Pre-assessment– Evaluate your situation in front of the PCI requirements applicable
• SAQ A PCI DSS – Support in the selection and completion of the SAQ right (SAQ/AOC), based on validation of evidence.
• Reduction of scope of PCI – Strategies to limit the exposure of data
• Validation in third – Evaluation to suppliers that process data card
• Tokenization: We evaluate or suggest ways to remove the BREAD from the environment
•  3D Secure – Solutions to protect data and authenticate users in digital payments, reducing risk and improving compliance

🔑 PCI PIN – Protection of data of PIN

We help to meet the technical requirements of safety PIN, both physical and digital.

• GAP-PCI PIN – Preliminary assessment
• Evaluation officer PCI PIN – Validation complete with technical approach
• Implementation (Phase I, II, III) – Accompaniment controls complexes
• Third-party validation – Evaluation of providers that handle PIN
• Action plans – Closure of findings subsequent to the audit

We offer a complete portfolio of services that strengthen the digital safety of our customers, beyond regulatory compliance.

⚙️ Vulnerability Management

We identify, validate and mitigate risks before they become incidents.

• Ethical Hacking – Simulation of controlled attacks
• Penetration testing (internal and external) – Technical verification of actual exposure
• Vulnerability scanning – Automation and continuous analysis
• Social engineering – Simulations of phishing, vishing attacks and face-to-face

🛡️ Application security

We validate the safety of your applications from the code to the execution.

• Secure code review – Identification of errors and vulnerabilities
• Web Scan – Automated scanning of web applications
• Penetration testing in apps – Logical evaluation and technical security

🔒 Information security

Strengthen your ISMS according to the main international standards.

• GAP ISO 27001 – Diagnosis compared to the standard
• Risk assessment – Identification and prioritization of threats
• Implementing ISO 27001 – Design, documentation and deployment of the ISMS
• Internal audit ISO – Check prior to the certification
• Personal data – Compliance with Habeas Data, GDPR and other regulations
• Transition to ISO 27001:2022 – Support migration from previous versions

🎓 Technical training and Executive

We train your teams to operate safely and comply with standards.

• Ongoing PCI DSS v4.0.1 – Training in technical compliance and documentary
• Course ISO 27001 – Implementation and maintenance of the ISMS

Course Development Software assurance – Good practice for devs and QA

We work with all the actors that are part of the ecosystem of digital payments, understanding your role, risks and regulatory obligations.

💼 Segments we serve:

• Financial: banks, issuers, acquirers, processors
• Technology: fintechs, data center, SOCs, payment gateways, call centers
• Trade and consumption: e-commerce platforms, insurance companies, loyalty programs
• Emerging payments: private cards, money orders, instant payments, payments, P2P, open banking, BNPL (Buy now, pay later”)

🧩 Each type of organization has unique challenges. Our approach is tailored to ensure compliance without slowing your operation.

• ✅ We are the only signing colombian certified as a QSA and QPA by the PCI SSC
• 💧 We have more than 17 years of experience security of payments in Latin america and the Caribbean
• 🧠 Our team has global certification in security and compliance digital
• ⚖️ We provide a impartial approach and strategic
• 📋 We integrate timelines, tracking, and direct support in all the process

🔒 Rather than comply, we ensure that safety accompanies your growth.

• The authentication resistant to phishing replaces the exclusive use of passwords with more secure methods such as passkeys, biometrics or physical keys security. These systems are designed to prevent an attacker can capture or reuse credentials, even if the user is tricked with a fake site.

  What are the advantages?

  • Better security: The cryptographic keys are unique and can not be intercepted.
  • Phishing prevention: The credentials do not work outside of the authoritative domain.
  • Better user experience: No need to remember passwords.
  • Lower operating costs: Reduced tickets for forgotten passwords.
  • Regulatory compliance: Technologies such as FIDO2 facilitate compliance with frameworks such as PCI-DSS.

  What to have in mind to implement it?

  • To assess the current infrastructure.
  • Adopt technologies such as FIDO2/WebAuthn.
  • Design a progressive strategy of adoption.
  • Train users and technical teams.
  • To ensure interoperability between devices and browsers.

  
  It is not just to change passwords for other tool. It is a transformation in the architecture of authentication. From IQ Information Quality help you to implement these solutions securely and in line with the objectives of the business.

Traders can guarantee the security of your payment page in two main ways:

1. Implementing protection techniques

To protect your site against attacks of scripts, traders should take the following measures:

• To comply with the requirements of PCI DSS: Implementing the practices outlined in the requirements 6.4.3 and 11.6.1 of the PCI DSS, including protection against unauthorised modifications to the source code and the detection of suspicious changes on the site.
• Use a Content Security Policy (CSP): Configure a security policy content that restrict the execution of unauthorized scripts and prevent the loading of malicious code.
• Implement Subresource Integrity (SRI): Ensure that the external scripts are not manipulated by validating their digital signatures.
• Monitor and scan the site regularly: Use monitoring tools and scan to detect any unexpected changes in the code or the inclusion of scripts suspects.

These measures can be applied by the trader or by a third party specializing in cyber security.

2. Obtaining confirmation of the TPSP or payment processor

Another way to ensure the security of the payment page is to verify that the payment service provider implements techniques of protection against attacks of scripts. To do this, merchants should:

• • Confirm with the TPSP that your payment solution embedded is protected against attacks of scripts.
  • Strictly follow the instructions of the vendor for the correct implementation of the iframe payment.
  • Request documentation demonstrating compliance with PCI DSS the payment solution offered.