Security that is designed, measured and sustained.

An assessment of the current state against recognised frameworks, compared with what is expected of an organisation of the same size, sector and risk profile. It is the baseline everything else is built on.

No intrusive testing required. The focus is on how the organisation actually operates: processes, responsibilities, existing controls and available evidence.

• Current maturity level and a target reachable within 12 months
• Gaps identified and ranked by risk
• A prioritised portfolio of initiatives with estimated effort
• Executive material for the board or the committee

This is the axis the brand is named after. We define how security should end up: which controls must exist, where they sit within the network and the systems, who operates them and how their effectiveness is verified. It applies both to designing a new platform and to redesigning one already in production.

The approach is practical. We work with the infrastructure the organisation actually has —the network, the systems and the existing processes— and not with a reference model that nobody can implement afterwards.

• Target architecture and a control model by domain
• Network segmentation and security zone design
• Internal technical guidelines and standards
• Integration architecture and service exposure
• Security review of new projects and initiatives
• Technology lifecycle: obsolescence and technical debt
• Security requirements for third-party integration

A structured review of every duty set by the Act and by the ANCI instructions, establishing the compliance status and the evidence behind it. If the organisation could be designated an Operator of Vital Importance, the reinforced standard applying to that group is assessed as well.

• Governance, roles and formal assignment of responsibilities
• Asset inventory and the risk management process
• Access control, segmentation and vulnerability management
• Monitoring, detection and incident handling
• Backups, operational continuity and supplier management
• Procedure for notifying incidents to the ANCI

The scope goes far beyond the privacy policy. The work starts by establishing what personal data the organisation processes, where it lives, for what purpose it is used and on what legal basis. That record is usually the first gap, because in most cases it does not exist.

Next comes the operational side: consent that can be proven, and a real workflow —with owners and deadlines— for handling data subject requests.

• Personal data inventory and record of processing activities
• Purpose and lawful basis for each processing activity
• Provable consent, cookies and a consent management platform (CMP)
• Data subject rights: workflows, owners and deadline control
• Retention, processors and international transfers
• Impact assessment (DPIA) where required

Readiness work defines what must be complied with. This line delivers the where it gets recorded: an in-house platform, customisable for each organisation, that carries the day-to-day operation of Ley 21.719 and leaves dated evidence of every decision.

The point is not having a cookie banner. It is that, when the regulator, a client or an audit asks, there is a record of what each individual accepted, when, against which wording, and what was done with every request received.

• Cookie management and preference centre: site scanning and classification by purpose, type, lifetime and provider
• Consent record: what was accepted, when and against which version of the wording, with a change history
• Data subject rights: intake of requests, owner assignment, deadline control and full traceability of each case
• Record of processing activities kept as a living inventory, not as a stray spreadsheet
• Impact assessment (DPIA) with a guided workflow and evidence attached to the processing assessed
• Evidence export and reporting for an audit or a regulator request

It adapts to the organisation's visual identity, to its real processing purposes and to its structure of accountable owners. After go-live it can be run by the internal team or kept as a managed service, deadline tracking of requests included.

A platform does not replace the groundwork. If purposes, lawful bases and accountable owners are undefined, the tool merely automates an incomplete record. That is why it is implemented on top of service line 04, or on equivalent work already done.

Most organisations have already invested in security tooling. The problem is rarely that it is missing: it is that it was left misconfigured, out of date, carrying inherited rules nobody ever revisited, or with no one accountable for running it day to day.

This line covers both fronts: the technical review of each platform and, where needed, permanent administration of the consoles. The aim is for the tooling to actually deliver the level of protection being paid for.

• Perimeter and internal firewall: rules, policies and clean-up
• WAF and protection of published applications
• IPS/IDS and network threat detection
• Web filtering and content control
• Email security and anti-phishing
• Antivirus and protection of workstations and servers
• VPN, remote access and privileged access control
• Ongoing console administration and rule change management

On that foundation a virtual SOC sized to each business can be built: monitoring of the events that matter, periodic alert review and an agreed response, without the cost or the structure of an in-house operations centre. Scope, hours and priorities are set by the organisation.

Controlled offensive testing, run under express authorisation and documented rules of engagement. The aim is to reproduce the path a real attacker would take and to record the full exploitation chain.

The difference is in the report. Raw tool output is not delivered: every finding goes through false-positive triage, is ordered by business impact and comes with concrete remediation. The report reads at two levels, executive and technical.

• Internet-facing attack surface
• Web applications
• APIs and integrations
• Internal network
• Internal infrastructure and services

An organisation's security does not stop at the firewall. Physical access to premises, equipment rooms and warehouses is as real a risk vector as the digital one, and both statutes in force treat it as part of the protective measures required.

This line integrates the design and assessment of electronic security with the rest of the architecture: same risk criteria, same deliverable format, and controls that talk to each other instead of operating as isolated systems.

• CCTV with video analytics: people and vehicle detection
• Licence plate reading cameras and facial recognition
• Access control for buildings, floors and restricted areas
• Vehicle barriers, intercom and video door entry
• Fire detection systems, conventional and addressable
• Convergence with digital identity and risk assessment of the physical perimeter

Implementation and installation of the electronic systems is carried out together with specialised, certified partners. PIMX ArcSec owns the design, the security requirements, the integration with the architecture and the validation of the result.