QSA Accredited by the PCI SSC

Payment Security

Comprehensive assessment, audit, and certification services for PCI Security Standards Council standards. Accredited as a QSA since 2007, we assist financial institutions, payment processors, merchants, and service providers with PCI DSS, PCI PIN, PCI SSF, and PCI 3DS compliance.

PCI DSS
Data security standard compliance and certification
PCI PIN
Security in PIN transaction processing
PCI SSF
Software Security Framework for payment applications
PCI 3DS
Audit of the 3-D Secure authentication protocol
The context

Why is security in payment methods critical?

The payments ecosystem is one of the most regulated and targeted environments in the digital landscape. Each card transaction involves a flow of sensitive data—card numbers, PINs, authentication data—that must be protected at every point in the chain: from the payment terminal to the processor, including the applications and infrastructure that support them.

The PCI Security Standards Council (PCI SSC) establishes the benchmark standards. Internet Security Auditors, as an accredited QSA, provides organizations with a catalog of services specialized in PCI compliance, allowing each need to be addressed individually or according to the organization's level of maturity and objectives.

PCI DSS
PCI PIN Security
PCI SSF (Secure SLC + Secure Software)
PCI 3-D Secure
PCI DSS

PCI DSS Implementation and Certification

PCI DSS (Payment Card Industry Data Security Standard) is the security standard that defines the requirements for managing security, policies and procedures, network architecture, software design, and protective measures involved in the handling, processing, or storage of credit card information, in order to reduce fraud.

Internet Security Auditors, accredited as a QSA by the PCI SSC since 2007 and the first Spanish company to obtain this certification, supports merchants, service providers, and financial institutions throughout the entire process: compliance analysis and action plan, implementation of requirements, certification audit, PCI DSS Technical Office (TPO), self-assessment questionnaire (SAQ), and quarterly vulnerability scans (ASV).

PCI PIN

PCI PIN Implementation and Certification

PCI PIN Security defines the requirements for the secure management, processing, and transmission of PINs in online and offline card transactions, at ATMs, and at attended and unattended point-of-sale (POS) terminals. It is intended for acquiring institutions and agents, key injection facilities, and certificate processors.

Internet Security Auditors was one of the first 5 companies in the world to be qualified as a QPA (Qualified PIN Assessor) by the PCI SSC and is the only Ibero-American company with this accreditation. We provide support from compliance analysis and action planning, and requirement implementation, to the biennial certification audit.

PCI SSF

PCI SSF Implementation and Certification

The PCI Software Security Framework (SSF) is a collection of standards and programs for the security of payment software design and development. It consists of the Secure Software Standard (SSS), with requirements for creating secure payment software, and the Secure Software Lifecycle Standard (SSLCS), for integrating security throughout the software lifecycle.

We perform compliance environment analysis, status reporting and action planning, PCI SSS certification auditing, and gap analysis against version 2.0 of the Secure Software Standard for applications certified with version 1.2.1.

PCI 3DS

PCI 3DS Audit

The PCI 3DS v1.0 (2017) standard, published by the PCI SSC, establishes security requirements and assessment procedures for components of the EMV® 3‑D Secure ecosystem: ACS, DS, and 3DS Server. It defines the physical and logical controls necessary to protect critical authentication functions and the associated processes and data.

The PCI 3DS audit is carried out in four phases: preparation and kickoff, audit (documentary, procedural, and technical review), preparation of compliance documents (Report on Compliance and Attestation of Compliance), and delivery of results.

Testimonials

What our clients say

Frequently Asked Questions

We answer your questions

Which organizations are required to comply with PCI DSS?

Any entity that stores, processes, or transmits payment card data: merchants, processors, acquirers, issuers, and service providers. The validation level (SAQ or ROC) depends on the transaction volume and the channel (card-present, e-commerce, etc.).

What is the difference between PCI DSS v3.2.1 and v4.0?

PCI DSS v4.0 introduces a continuous validation approach, broader multi-factor authentication requirements, extended encryption, and a new Customized Approach that allows demonstrating security through alternative controls. As of March 2025, it is the only valid version.

How long does a PCI DSS certification process take?

It depends on the size of the environment, the maturity of the controls, and the level of prior compliance. A full cycle, from the initial GAP analysis to the issuance of the ROC, can range from 3 to 9 months. Organizations with prior certifications and mature controls can complete it in less time.

What is PCI SSF and how does it differ from PA-DSS?

PCI SSF (Software Security Framework) is the successor to PA-DSS. It includes two programs: the Secure Software Standard (security requirements for payment software) and the Secure SLC (requirements for the secure development lifecycle). Unlike PA-DSS, SSF covers modern software such as cloud applications and payment APIs, not just packaged applications.

Do I need PCI PIN if I already have PCI DSS?

Yes, they are complementary. PCI DSS protects card data in general, while PCI PIN focuses specifically on the security of the PIN block during its capture, encryption, transport, and processing. If your organization participates in PIN transactions (acquirers, processors, networks), PCI PIN is an additional requirement.

Contact

Do you need to become PCI compliant or certified?

Tell us about your situation and our team of QSAs will get in touch with you to provide guidance or schedule a technical call.

Offices
Barcelona · Madrid · Bogotá
R
Ricardo Andrés Cárdenas
2 months ago

Working with Internet Security Auditors has been a highly satisfactory experience. Their support in the migration to ISO/IEC 27001:2022 and the PCI DSS certification process has been fundamental in strengthening our ISMS.

A
Andrés Mejía
3 months ago

Your team combines solid technical expertise with a strong willingness for collaborative work, which has strengthened our security posture and regulatory compliance.

V
Victoria Villarreal Palazón
4 months ago

They have been our indispensable partner for the implementation of GDPR requirements. I would highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions.

M
Miguel Acosta
5 months ago

The entire PCI DSS Attestation of Compliance process was extremely fast, efficient, and professional. We undoubtedly recommend their services to any company in need of cybersecurity solutions.

S
Sergio Sainz de la Maza
6 months ago

We have been working with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility. I recommend them without hesitation.

Request information

We will contact you as soon as possible.
Global Presence

Our offices

Barcelona

C. Santander, 101. Building A-2
E-08030 Barcelona (Spain)

+34 93 305 13 18
Madrid

Arequipa St., 1
28043 Madrid (Spain)

+34 91 763 40 47
Bogotá

Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)

+57 601 638 68 88
25
years of experience in cybersecurity
Contact us