Corp package 64 final: the kit a Mexican corporate hands out so phishing and vishing do not walk off with the employee's password
The Mexican corporate operating under ISO 27001 knows that information security does not stand on firewall and SOC alone if an employee receives a vishing call pretending to be IT, lets an attacker through the door who installs ransomware, or leaves the 2FA key in the desk drawer next to the unlocked phone. The Corp package 64 final ships a FIDO2 physical 2FA security key, a magnetic webcam cover, a hardware AES-256 encrypted USB, a printed physical and digital phishing detection guide, a Kensington lock for laptop with encryption, an RFID blocking sleeve for corporate cards, a desktop poster on social engineering, and an incident response guide. CFDI 4.0 is issued under key G03 on the cybersecurity line, fully deductible under article 27 of the LISR.
Why cybersecurity fails when culture is not trained with objects
The Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its regulations require Mexican corporates to implement administrative, technical and physical security measures to protect personal data. NOM-151 regulates the conservation of data messages and advanced electronic signatures. The Mexican corporate certified in ISO 27001 knows that the weakest link in the security chain is the employee who receives a vishing call, opens a phishing attachment, or uses the same password for corporate email and social networks.
The Mexican corporate spends on average between USD 65 and 210 per employee per year on security awareness training that leaves no tangible tool behind. The Corp package 64 final rationalises that spend and ships a standardised kit that backs the daily work of the CISO and the IT area: the 2FA key replaces vulnerable SMS, the webcam cover blocks spying, the encrypted USB protects sensitive data, the poster reminds the signals of physical phishing. The invoice is segregated from general expenses and reported as information security investment.
For corporates with active cybersecurity programmes (Red Team, Blue Team, Phishing Simulations, Bug Bounty Programme, Information Security Committee), the kit is delivered with the programme calendar and QR code for registration on the internal tracking platform. The CISO area receives a dashboard with compliance by area, percentage of employees with 2FA key, and click rate on phishing simulations after the kit. The invoice is segregated from training spend and reported as human capital investment.
For corporates with multiple legal entities and nationwide operations, the kit is delivered in a single order with lots segregated by RFC and independent invoicing per entity. Premium logistics with DHL or Estafeta deliver in 3 to 5 business days to any state in the country, with tracking and delivery confirmation. For free zone deliveries (typical of IMMEX with employees in Baja California or Sonora), VAT is calculated at 0% rate and the Free Zone complement is attached with the SAT authorisation number.
Components of the Corp package 64 final
The full kit weighs 380 grams and is delivered in a rigid box with anti-tampering holographic seal and QR code for registration on the corporate security platform. Each element carries an internal serial number and manufacturer lot for traceability and incident reporting.
FIDO2 physical 2FA security key
USB-A and USB-C security key with NFC, FIDO2/WebAuthn certification, ECC p256 public key cryptography, phishing and man-in-the-middle resistance, compatible with Google, Microsoft, GitHub, Facebook, Twitter and more than 1,000 services, polycarbonate body with IP68 certification, physical confirmation button, and unique serial number. The key is delivered with a step-by-step configuration guide and corporate IT area support for enrolment. Black with laser-engraved employee name. NIST SP 800-63B level 3 compliant.
Magnetic sliding webcam cover
Anodised aluminium webcam cover with 3M VHB magnetic adhesive that leaves no residue, horizontal sliding mechanism to cover the camera when not in use, ultra-thin 0.8 mm design, compatible with MacBook, Dell, HP, Lenovo, ASUS and most corporate laptops, universal 18×5 mm size. The cover is delivered in individual blister pack with QR code to 90-second installation video. Complies with LFPDPPP and GDPR privacy directives.
AES-256 encrypted USB
USB 3.2 Gen 2 with AES-256 XTS hardware encryption, 64 GB capacity, 250 MB/s read and 130 MB/s write speed, authentication with 7 to 15 digit PIN on device physical keypad, auto-lock after 10 failed attempts, IP57 water and dust resistance, reinforced zinc body, and unique serial number. The USB is delivered with remote management software compatible with Windows, macOS and Linux. FIPS 140-2 level 3 and Common Criteria EAL5+ compliant. Graphite colour with laser logo.
Printed physical and digital phishing detection guide
Printed guide on FSC certified paper with 48 colour pages, 14×21 cm format, sewn binding, with real phishing examples in Mexican Spanish (fake messages from BBVA, Banorte, SAT, Mercado Libre, Amazon, DHL), vishing signals (fake IT or Microsoft support calls), smishing signals (fake courier SMS), deepfake signals (synthetic audio and video), and incident response protocol with CERT-MX and Cyber Police numbers. The guide is delivered with recycled card stock bookmark.
How the cybersecurity kit is invoiced under ISO 27001 and LFPDPPP
The Corp package 64 final operates in two invoicing modes. The first is closed monthly order with CFDI 4.0 issued at month-end with line-by-line description for deduction as information security spend. The second is annual contract with fixed unit price and invoice against actual delivery each quarter, with payment complement at 30 days when the corporate operates on credit lines.
CFDI Use depends on the client tax regime and the receiving area. For the General Regime with IT or CISO area, the invoice is issued under G03 (general expenses) on the information security investment line. For RESICO, the same key is used because the kit counts as human capital investment. Validation with the accounting area happens before the first batch to confirm the specific expense account and the correct key.
VAT 16% is broken down line by line on CFDI 4.0. For free zone deliveries (typical of IMMEX with employees in Baja California, Sonora or Tamaulipas), VAT is calculated at 0% rate and the Free Zone complement is attached with the SAT authorisation number. For interstate deliveries with Carta Porte, the Carta Porte 3.0 complement is attached with carrier data and documented origin-destination.
CFDI cancellation or correction is processed within 24 hours of the request. For model or specification changes after the kit has been delivered, we handle replacement with additional charge and new CFDI for the additional piece. A kit not delivered because the employee left before day one is invoiced only if the order confirmation was signed by the CISO area at least 5 business days in advance.
Sizes, colours and stock curve
The 2FA key is universal with USB-A/USB-C and NFC connection. The webcam cover is universal with magnetic adhesive. The encrypted USB is universal with 64 GB capacity. The guide is universal in 14×21 cm format. For corporates with extended security programmes, we offer a 128 GB USB version with surcharge and additional production time.
Key and cover colours are selected on the first order and kept stable to build brand identity. Common combinations in Mexican corporates: black key + black cover + graphite USB + colour guide for administrative and financial profiles; black key + graphite cover + graphite USB + colour guide for technical and operational profiles; black key + blue cover + graphite USB + colour guide for commercial and customer service profiles.
For corporates with more than 100 employees in the cybersecurity programme, we run a rotating warehouse stock with monthly replenishment. The corporate pays for the kit only when assignment to the employee is confirmed, with no minimum volume commitment. Premium logistics with DHL or Estafeta deliver in 3 to 5 business days to any state in the country. For corporates with multiple legal entities, lots are segregated by RFC with independent invoicing per entity.
Pricing, MOQ and lead times
Prices in MXN before VAT 16%. The Corp package 64 final starts at MXN 2,180 per unit from MOQ 25. In quarterly batches of 80 kits or more, the cost drops to MXN 1,840. In annual contracts of more than 1,200 kits with quarterly deliveries, the cost drops to MXN 1,580 with reserved safety stock in our CDMX and Guadalajara warehouses. CFDI 4.0 is issued at month-end with full deductibility under information security investment spend.
Production lead times are 15 to 18 business days for kits with personalisation and individual engraving. Batches of more than 100 kits require 22 to 25 business days with scheduling 6 weeks before the first day of the quarter. Delivery is made to the corporate office with CISO acknowledgement or directly to the employee's home with tracked shipping.
For corporates with IMMEX free zone operations, the kit is assembled in Tijuana or Monterrey with cross-border delivery in 24 to 48 hours and carta porte with 0% VAT. For corporates with multiple legal entities and centralised CISO, we run consolidated kit with breakdown per entity on a single invoice with RFC-separated lines.
FAQ — Corp package 64 final
Does the 2FA key comply with FIDO2 and WebAuthn?
Yes. The key complies with FIDO2/WebAuthn, the passwordless authentication standard developed by the FIDO Alliance. It is compatible with Google Workspace, Microsoft 365, GitHub, Facebook, Twitter, Dropbox and more than 1,000 services. ECC p256 public key cryptography protects against phishing, man-in-the-middle and replay attacks. The key has IP68 certification and is delivered with step-by-step enrolment guide. Corporate IT area support is included during the first 30 days.
Does the encrypted USB have FIPS 140-2 certification?
Yes. The USB has FIPS 140-2 level 3 and Common Criteria EAL5+ certification. AES-256 XTS hardware encryption protects data even if the memory is physically extracted. The PIN authentication on the device physical keypad is independent from the system, avoiding keylogger attacks. The auto-lock after 10 failed attempts erases the encryption key. Remote management allows the corporate CISO to reset the PIN or deactivate the device remotely in case of theft.
Does the guide cover physical and digital phishing?
Yes. The guide covers digital phishing (fake emails with malicious attachments), physical phishing (USBs left in the parking lot or waiting room), vishing (fake calls from support or the bank), smishing (fake SMS from courier or banks) and deepfake (synthetic audio and video of executives). For each type, the guide includes warning signals, real examples in Mexican Spanish and response protocol with CERT-MX and Cyber Police 088 numbers.
Can you include a Kensington lock for corporate laptop?
Yes. For corporates with physical security programmes, we add a Kensington lock with 4-digit encryption, 1.8 metre galvanised steel cable, 360-degree rotating head and lock mechanism with master key for the IT area. The lock is invoiced separately with its own line on CFDI 4.0 under the physical asset security line. Compatible with laptops that have standard Kensington slot and with external monitors.
How does the RFID blocking sleeve for corporate cards work?
Yes. For corporates with corporate credit cards, we supply passive RFID sleeve that blocks NFC reading when the card is not in use. The sleeve sticks to the inside of the corporate wallet and protects against contactless skimming. The card is delivered with test card and verification guide. It is invoiced separately with its own line on CFDI 4.0 under the financial protection line.
Do you offer a desktop poster with incident response protocol?
Yes. For active awareness programmes, we include a laminated poster 30×40 cm with step-by-step protocol: incident detection, initial containment, escalation to IT area, reporting to CISO, evidence preservation, communication with authorities (CERT-MX, Cyber Police, CONDUSEF when applicable). The poster is placed on the employee's desktop and renewed annually with the updated protocol version. It is invoiced separately with its own line on CFDI 4.0.