Consulting and assurance · MSPI · ISO/IEC 27001 · NIST CSF 2.0
We audit the implementation of the Information Security and Privacy Model (MSPI), issued by Colombia's MinTIC, with a fixed scope, a findings report with evidence and an action plan. We know ISO/IEC 27001 and the NIST Cybersecurity Framework (CSF 2.0), references we also work with.
The MSPI (Information Security and Privacy Model) is the model issued by Colombia's Ministry of ICT (MinTIC) that obligated entities must adopt as an enabler of the Digital Government policy under Resolution 500 of 2021. An MSPI internal audit verifies, in a planned and documented way, the state of its implementation and which findings need to be closed. It ends in a report with findings and evidence.
Resolution 2277 of 2025 updated Annex 1 of Resolution 500 of 2021 to align the model with ISO/IEC 27001:2022. The MSPI is an adoption model for obligated entities; ISO/IEC 27001 is a certifiable standard. They are different references, and an internal audit helps you see where your entity stands against both.
Each format has its scope, timeline and deliverables defined from the proposal. Dress Rehearsal, which simulates a certification audit, does not apply to the MSPI.
Express internal audit to meet your annual requirement with clear findings.
Audit by risk or critical topic to audit only where the risk is.
The timelines are FORQUANTIQ consulting time. The proposal confirms the timeline according to your scope. Want to see the full portfolio? See the 10 consulting and assurance products.
The audit is performed by internal auditors certified in ISO/IEC 27001. They have knowledge of the MSPI and of the NIST Cybersecurity Framework (CSF 2.0). It is a personal certification of the auditors.
FORQUANTIQ does not issue ISO certificates. Certification is granted by an accredited body of your choice. Our internal audit prepares your company and does not replace the certification audit. The audit scope does not include technical testing of your infrastructure, and it does not replace the reviews of your internal control office or of oversight bodies.
The MSPI is the Information Security and Privacy Model issued by Colombia's Ministry of ICT (MinTIC). Under Resolution 500 of 2021, obligated entities must adopt it as an enabler of the Digital Government policy.
It is the planned, documented verification of the state of implementation of the MSPI in an entity. It ends in a report with findings and evidence, and in an action plan to close them.
For the entities obligated by the Digital Government policy, yes: Resolution 500 of 2021 requires them to adopt it. Check whether your entity is an obligated entity.
It updated Annex 1 of Resolution 500 of 2021 to align the model with the 2022 edition of ISO/IEC 27001.
The MSPI is an adoption model for obligated entities and is aligned with ISO/IEC 27001. ISO/IEC 27001 is a certifiable standard. They are different references.
Yes. FORQUANTIQ knows the NIST Cybersecurity Framework (CSF 2.0) and the ISO/IEC 27001 standard, and works with both as references in information security.
It depends on the format: Flash Check is 2 days of audit and Focused Audit is 3 days, and in both the report is delivered within 2 business days. These are FORQUANTIQ consulting days; the proposal confirms the timeline according to your scope.
Yes. Both formats have a fixed scope, agreed in the proposal before work begins. Focused Audit concentrates on a risk or critical topic.
Each proposal defines scope, timeline, deliverables and fee before work begins, and any scope extension is agreed in writing before it is carried out. Request your proposal and we will send it with the fee for the scope you need.
It is performed by internal auditors certified in ISO/IEC 27001, with knowledge of the MSPI and of NIST CSF 2.0. It is a personal certification of the auditors.
No. The audit scope is the implementation of the model and its evidence. It does not include technical testing of your infrastructure.
Depending on the service and scope: for example, Flash Check can be done remotely or on-site. The format is defined in the proposal.
Under a confidentiality agreement before we start, in accordance with Colombian Law 1581 of 2012 and FORQUANTIQ's personal data processing policy.
Tell us about your situation and we will propose the format that fits best. We reply within 24 business hours.
You can also write to us at info@forquantiq.com.
