PCI PIN · QPA Certification

Compliance and Certification
PCI PIN

Internet Security Auditors, with its expertise in information security consulting and auditing, is prepared to assist all organizations required to define and maintain a compliance program for PCI PIN requirements.

Phase 1, Compliance Analysis
Process evaluation and action plan
Phase 2, Implementation
PCI PIN Compliance Program
Phase 3, QPA Audit
Biennial on-site certification
The standard

What is PCI PIN?

Payment Card Industry PIN Security (PCI PIN) is a security standard that defines the set of requirements for the secure management, processing, and transmission of personal identification number (PIN) data during the processing of online and offline payment card transactions at attended and unattended ATMs and point-of-sale (POS) terminals.

Its purpose is to reduce fraud, protect sensitive payment information, and increase the security of this data.

PCI PIN, along with the rest of the programs in the PCI family, is the result of the efforts of the PCI Security Standards Council (PCI SSC) formed by the major payment card issuing companies (VISA, MASTERCARD, AMERICAN EXPRESS, JCB, DISCOVER), and is intended for use by all institutions and acquiring agents such as key injection facilities and certificate processors responsible for processing PIN transactions on behalf of payment card industry participants, and must be used in conjunction with other applicable industry standards.

Our accreditation

Qualified PIN Assessor (QPA)

The PCI PIN program, which had been managed by VISA since its first version in 2011, underwent a transition process to become the responsibility of the PCI SSC following the publication of version 3.0 in August 2018. Internet Security Auditors was one of the first 5 companies worldwide to pass the qualification process defined by the PCI SSC in the QPA (Qualified PIN Assessor) program, which began in 2019.

Internet Security Auditors, with its experience in information security consulting and auditing, is prepared to assist all those organizations that are required to define and maintain a compliance program for the requirements demanded by PCI PIN.

Compliance Status Analysis
Risk Assessment and Prioritization of actions
Compliance Program
Implementation of Requirements for compliance
Compliance Audit
PCI PIN Technical Office
Our services

How we work

Internet Security Auditors, through its implementation consulting service, aims to provide organizations with all the necessary support and guide them in defining and maintaining a PCI PIN compliance program.

01Compliance Analysis and Action Plan
The first step to complying with PCI PIN requirements is to conduct an analysis of the company's processes involving PINs, key injection and encryption key management processes, etc.

Once these processes are clearly identified, risks must be assessed and alignment activities defined to establish and maintain the security measures necessary to comply with the requirements defined in the standard that apply to those processes. In the case of KIFs (Key Injection Facilities), the set of requirements will be a portion of those mandated by the standard.
02Implementation of requirements for adaptation
The Implementation of Requirements for Compliance executes the compliance program for the non-conformities detected in previous phases by carrying out consulting and advisory activities for any task that must be developed to achieve the goal of PCI PIN compliance.
03PCI PIN Compliance Certification Audit
Internet Security Auditors is accredited by the PCI SSC, through its QPA certificate, to perform the required biennial on-site audits. During the audit process, technical and procedural reviews are used to verify that the requirements established in PCI PIN are being met. For any points that are not met, an action plan is defined to resolve the non-conformities.
Related Services
PCI DSS Implementation and Certification PCI SSF Implementation and Certification PCI 3DS Audit ISO Management Systems European Regulation Strategy & CISOaaS Continuity & Resilience

Scope of service

What this service covers

PIN process analysis

Evaluation of all business processes related to the management and processing of PIN data.

Risk assessment

Identification and analysis of risks associated with PIN processing in payment transactions.

Key Injection Facilities (KIF)

Specific requirements for key injection facilities and their security processes.

Compliance program

Definition and maintenance of the compliance program with all PCI PIN requirements.

Technical and procedural reviews

Technical analysis of the infrastructure and PIN processing systems, and evaluation of the operational and security procedures related to their management.

QPA biennial audit

Biennial on-site audits required by the PCI SSC performed by accredited QPA assessors.

Testimonials

What our clients say

Working with Internet Security Auditors has been a highly satisfactory experience. Their support in migrating to the ISO/IEC 27001:2022 standard, conducting internal audits, and the PCI DSS certification process has been fundamental in strengthening our information security management system.

Ricardo Andrés Cárdenas Galvis
Information Security Office · Neurona

The strategic support of Internet Security Auditors as CISOaaS has been fundamental in strengthening our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance more quickly in our cybersecurity maturity.

CISO
RACC

On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.

Yulian Colmenares
Information Security Office · Outsourcing SAS BIC

Working with Internet Security Auditors has been a positive experience in every respect. Their team combines solid technical expertise with a great willingness to collaborate, which has strengthened our security posture and regulatory compliance.

Andrés Mejía
Head of GRC · Payválida

As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner for the implementation of the requirements set forth by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…

Victoria Villarreal Palazón
Vice President & Associate CFO · Saint Louis University

As the CFO of Fleurop - Interflora Spain, we have been working with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a company 100% oriented towards online commerce, the professional services of Internet Security Auditors provide us with support, security, and the peace of mind that all our activity is aligned with GDPR compliance.

Francisco Tébar Prada
CFO Southern Europe · Fleurop - Interflora Spain

As CISO at Intaremit S.A., we place the highest level of importance on logical security. Not only due to the mere fact that PCI-CPP regulations require us to conduct 4 internal and external vulnerability scans and an annual internal and external pen-test, but also for the security and peace of mind our company aims to provide to each and every one of its clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; therefore, I recommend them without hesitation.

Sergio Sainz de la Maza
CISO · Intaremit

At Grupo Arbulu, we have worked closely with Internet Security Auditors on the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.

Marcos Montes de Oca
CIO · Arbulu Group

As CEO of Beruby, we worked with Internet Security Auditors when we urgently needed to carry out a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. Without a doubt, we recommend their services to any company that needs cybersecurity solutions.

Miguel Acosta
Global CEO · Beruby

At Grupo AR, we highly value the brand protection service provided by Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team allows us to identify and mitigate risks that could affect the AR Construcciones brand and its various companies.

Nestor Ivan Melo Ballen
Cybersecurity Director · AR Group

Frequently Asked Questions

We answer your questions

What is PCI PIN and to whom does it apply?

PCI PIN is a PCI SSC security standard that defines the requirements for the secure management, processing, and transmission of PIN data during payment card transactions. It applies to acquiring institutions and agents, key injection facilities (KIFs), and certificate processors.

What is a QPA and why is it important?

QPA (Qualified PIN Assessor) is the PCI SSC accreditation that authorizes a company to conduct PCI PIN certification audits. Internet Security Auditors was one of the first 5 companies in the world to obtain this accreditation.

How often should the PCI PIN audit be performed?

The PCI PIN certification audit is biennial, meaning it must be performed every two years. This is a mandatory on-site audit that verifies compliance with all requirements of the standard.

What is the difference between PCI PIN and PCI DSS?

PCI DSS protects cardholder data in general (card number, expiration date, etc.), while PCI PIN specifically focuses on the security of the personal identification number (PIN) during its management, processing, and transmission. Both standards are complementary.

What does the PCI PIN consulting service include?

The service includes three phases: compliance analysis and action plan (evaluation of processes, risks, and definition of measures), implementation of requirements (compliance program and consulting), and certification audit (on-site technical and procedural reviews as an accredited QPA company).

Contact

Do you need to get PCI PIN certified?

Tell us about your situation and our team will contact you to provide guidance or schedule a technical call.

R
Ricardo Andrés Cárdenas
2 months ago

Working with Internet Security Auditors has been a highly satisfactory experience. Their support in the migration to ISO/IEC 27001:2022 and the PCI DSS certification process has been fundamental to strengthening our ISMS.

A
Andrés Mejía
3 months ago

Your team combines solid technical expertise with a strong willingness for collaborative work, which has strengthened our security posture and regulatory compliance.

V
Victoria Villarreal Palazón
4 months ago

They have been our indispensable partner for the implementation of GDPR requirements. I would highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions.

M
Miguel Acosta
5 months ago

The entire PCI DSS Attestation of Compliance process was extremely fast, efficient, and professional. We undoubtedly recommend their services to any company in need of cybersecurity solutions.

S
Sergio Sainz de la Maza
6 months ago

We have been working with Internet Security Auditors for over 10 years because of their experience, commitment, and accessibility. I recommend them without hesitation.

Request information

We will contact you as soon as possible.
Global Presence

Our offices

Barcelona

C. Santander, 101. Building A-2
E-08030 Barcelona (Spain)

+34 93 305 13 18
Madrid

Arequipa St., 1
28043 Madrid (Spain)

+34 91 763 40 47
Bogotá

Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)

+57 601 638 68 88
25
years of experience in cybersecurity
Contact us