Compliance that passes the audit and sustains growth

We assess your payment infrastructure, reduce the scope, implement the controls and organize the evidence in the format the assessor expects. When your route requires a formal assessment, it is conducted by a partner QSA credentialed by the PCI SSC, with the roles kept separate between who prepared and who assesses.

• Scope definition and a gap assessment of what is still missing
• Control implementation and cardholder data encryption
• Policies, procedures, and team training
• Certification support through completion

We build your Information Security Management System from assessment to certification, with BSI-certified Lead Auditors on the team.

• Gap analysis and remediation plan
• Control implementation and risk management
• Certification audit readiness
• Ongoing ISMS maintenance and continuous improvement

Compliance with CMN Resolution 4,893 and BCB Resolution 85 for financial and payment institutions: cybersecurity policy, incident management, and cloud contracting requirements.

• Mapping of requirements applicable to your institution
• Regulator-mandated cybersecurity policy
• Incident response plan and BACEN notification procedures
• Continuous compliance monitoring

We prepare your operation for the assurance reports enterprise customers demand most, from controls to evidence, with no surprises when the auditor arrives.

• Scope definition and trust services criteria
• Control design and implementation
• Evidence collection and auditor readiness
• Support throughout the observation period (Type II)

Your vendors are part of your risk surface. We assess third parties and contractors, review contracts, and implement a third-party risk management program that stands up to due diligence.

• Risk assessment of critical vendors
• Contract review and security clauses
• Standardized questionnaires and evidence
• Ongoing ecosystem monitoring

The other side of third party assessment. When it is your customer sending the security questionnaire, we build the dossier that answers all of them at once, with evidence in the format procurement accepts, and stay with you until approval comes through.

• A security dossier that answers the customer questionnaire
• Standard answers for the questions that keep repeating
• Evidence in the format procurement accepts
• Support through the audits your customer runs

A security master plan aligned with your business objectives: where you are, where you need to be, and the investment sequence that makes sense. Strategy first, then tools.

• Environment and current maturity assessment
• Strategy tailored to company size and industry
• Roadmap prioritized by risk and investment
• Progress indicators for executive leadership

From data flow analysis to data subject response: a complete program to achieve and maintain LGPD compliance, integrated with your security program.

• Data mapping and legal bases
• Privacy policies and data governance
• Data subject rights mechanisms
• Data protection training and culture