Society of Payment Security Professionals - Payment Security Blog

The Spanish QSA

If you download the latest QSA list, open it up and do a quick search for “Spain”, you’ll only come up with one name: Daniel Fernandez Bleda of Isecauditors.com, based right here in my home town of Barcelona.

I’d had someone contact me through my personal blog to talk about PCI, he was also based in Barcelona, and needed some pointers. As I am a vendor, I thought it prudent to get an independent expert in to keep his mind at rest. I was in contact with Daniel by email, but had yet to meet in person. He seemed to know what he was talking about, so I invited him in.

So, 5 of us (2 from my company, 2 from Daniel’s, 1 interested consumer) crammed into our offices at 3pm on Thursday afternoon to see what we could arrange. Daniel dealt with the queries as they arose, and very kindly conducted proceedings in English, which was obviously not his preferred method of communication. Still, a lot more natural than me speaking Spanish, so much appreciated. No hablo Espanol.

Backtracking a little, I had contacted Daniel previously to speak about PCI in Spain, thinking he would be inundated with business here, being in his unique position. We wanted to partner with him, being a vendor who might be able to surf the giant PCI wave… apparently this is not the case. Most of Daniel’s business comes from other auditing and compliance work. The QSA status (and soon to be ASV) is there to keep skills up to date and provide a little marketing. He was delighted to have the chance to speak about PCI with a real live opportunity in Barcelona.

The last time I spoke about the lack of interest in PCI in Spain I had someone on this blog (who shall remain nameless because I can’t remember who it was) tell me how they had loads of Spanish work on, but couldn’t tell me anything about them because it would breach NDA. Sorry, but I’m having difficulty believing you now, especially when you can’t provide ANY proof.

I’ve only been here 5 months now, but I’ve picked up PCI customers in the UK and US in that time, and still not a sausage in Spain, not even the scent of chorizo. We even have one of the largest banks in the area trying out our software, and the only PCI account I’ve even heard of over here is an international company getting pressure from their German processors. Caixa Catalunya passed on the pressure, but they aren’t interested for themselves in terms of PCI.

If there’s anyone more qualified to talk about PCI in Spain than Daniel, please let me know. I’d love to hear that I’ve completely missed a rich seam of business opportunity buried deep below the cracked surface of Spanish IT security.

I’m also interested to get more of an overview purely for personal reasons, otherwise I’m going nuts here.