Disclaimer: All information provided in these pages is meant to be helpful for a typical Sign, Print, or Graphics company. If your business model differs significantly from these typical establishments, these recommendations may not apply. In all cases, you are responsible for providing the correct answer and Cyrious assumes no direct or indirect liability with the guidance below.

Once you are logged into TrustKeeper at https://elavonpci.trustkeeper.net/, one of the steps is to set up your Compliance Questionaire. The information below is meant to help you answer those questions. Please note that the answers provided only concern Cyrious' applications. Many of the questions concern Cyrious and other applications you have and must be answered in this context.

The SAQ Questionaire is the document where you must attest that you are following all of the best practices necessary to secure the card holder information you come into contact with.

For users of Cyrious SMS or Control, Cyrious recommends you complete SAQ-D. If you never place a single credit card number into Control or SMS, and no employe ever has, ever does, or ever will then you probably qualify to use SAQ-C. This does not just apply to processing credit card information, but storing any credit card number in the system also. SAQ-C is easier to complete, but if you find that your or an employee has, does, or will put this information into Control you will end up not being in compliance.

The information below assumes you are using Questionaire D. If you are using another form, then this information does not apply to you.

Unfortunately, Cyrious does not know the status of your network. Our support technicians are not authorized to answer any questions on your network security. You will need to have these questions verified by someone knowledgeable about your specific network configuration. In some cases, you may need to make changes or implement additional security measures.

Cyrious SMS 8.9 pci and later and Cyrious Control 4.4 and later satisfy the requirements required of our software in Section 3. Stored Data Protection, but you must confirm these for all systems you use.

• Cyrious does not store any magnetic track data. (Question 4)
• Cyrious does not store the card-validation code. (Question 5)
• Cyrious does not store the PIN. (Question 6)
• Cyrious does mask the PAN except when authorized employees need access to this information. (Question 7)
• Cyrious does use strong cryptography (encryption) and key management for all stored sensitive information. (Question 8)
• Cyrious does not rely on disk encryption. (Question 9 & 10)
• Cyrious does use cryptographic keys for encryption against disclosure and misuse. (Question 11)
• Cyrious does restrict its encryption keys automatically. Once you enter your key the system uses it automatically and there is no way to retrieve it! (Question 12)
• Cyrious does store keys securely for you, in the fewest locations and forms possible. (Question 13)
• Though Cyrious does not require key retention, you should have a policy to change the key if the person who created it leaves the company or you believe the key is compromised. (Question 14)
• Cyrious does generate strong cryptographic keys. (Question 15)
• Cyrious does secure cryptographic key distribution between its applications. (Question 16)
• Cyrious does secure cryptographic key storage. (Question 17)
• Cyrious does change its internal security keys at least annually. (Question 18) (Note: Users not on support may be required to purchase the product update to obtain the changed keys.)
• Though Cyrious does not require key retention, you should have a policy to change the key if the person who created it leaves the company or you believe the key is compromised. (Question 19)
• Cyrious does split the knowledge and control of the cryptographic keys by having some of those keys controlled by Cyrious and some controlled by you. (Question 20)
• Cyrious' approach does automatically prevent substitution of cryptographic keys since different parties have different pieces. (Question 21)
• Cyrious' approach does not require a key custodian since the key is only asked for once and can never be retrieved. (Question 22)

Cyrious SMS 8.9 pci and later and Cyrious Control 4.4 and later satisfy the requirements required of our software in Section 4. Transmitted Data Protection, but you must confirm these for all systems you use.

• Cyrious does transmit all sensitive cardholder data using appropriate encryption on all networks. (Question 1)
• If you are using a wireless network, you must attest to its security settings. (Question 2)
• Cyrious does prevent the sending of any sensitive information through end-user messaging technologies when used correctly, but you need to make sure you have written and enforced policies that also prevent this. (Question 3)

Cyrious SMS 8.9 pci and later and Cyrious Control 4.4 and later satisfy the requirements required of our software in Section 6. Application and System Security, but you must confirm these for all systems you use.

• This requirement specifies that you must maintain the latest version of Cyrious Control or Cyrious SMS. (Questions 1,2)
• Cyrious is not considered a custom application for purposes of PCI certification. (Question 5, 6)
• Cyrious does not connect to a web system directly if you are not running WebView or Production Terminal. For these, you need to ensure that proper web security techniques are deployed.

Cyrious SMS 8.9 pci and later and Cyrious Control 4.4 and later satisfy the requirements required of our software in Section 7. Access Restrictions, but you must confirm these for all systems you use.

• This section requires you to set up your system and policies so that only users with a requirement for access to sensitive information actually can access that information. Remember to answer this not just as it applies to Cyrious but as it applies to all of your systems.

• Cyrious does not require additional automated access control system beyond those implemented in Windows. (Question 5)

Cyrious Control 4.4 and later satisfy the requirements required of our software in Section 8. Account Security, but you must confirm these for all systems you use.

• This section requires you to set up your system and policies so that only users accounts are established and tracked.
• Cyrious does allow you to create unique logins per employee. Your policy must ensure each employee uses their own account. (Question 1)
• Cyrious does use password authentication. (Question 2)
• Cyrious does not use two-factor authentication. (Question 3)
• Cyrious does secure passwords at all times using strong cryptography. (Question 4)
• Cyrious does control access to the user setup areas. (Question 5)
• Cyrious does require you to reenter your password before resetting yours or another password. (Question 6)
• Cyrious does require you to enter a unique password for a new user and can force that to password to be reset on first login. You must ensure your policy specifies the password must be changed on first login. (Question 7)
• Cyrious does automatically disable access for any employee that is no longer active. You must ensure your policy sets the employee inactive in Cyrious upon termination. (Question 8)
• You must ensure your policy is to remove the Cyrious login when they are no longer using the system. (Question 9)
• Cyrious does not provide access for vendors. (Question 10)
• You must not use any shared logins. Your policy must ensure each employee uses their own account. (Question 12)
• Cyrious does force users to change their passwords every 90 days. (Question 13)
• Cyrious does require a minimum of seven characters in the password. (Question 14)
• Cyrious does require passwords to contain both a number and letter. (Question 15)
• Cyrious does track the last 4 passwords used and prevent reuse of any of these passwords. (Question 16)
• Cyrious does automatically lock out a user for 30 minutes after 6 invalid attempts. (Question 17, 18)
• Cyrious Control does have an option to automatically lock the screen and require a password to resume. You need to make sure this option is turned on for all users with a time of 15 minutes or less. Cyrious SMS users must make sure they enable the Windows screen saver to lock the screen after 15 minutes or less of inactivity and then require a password to log back in. (Question 19)
• Cyrious does automatically require authentication for any database access. (Question 20)

Cyrious SMS 8.9 pci and later and Cyrious Control 4.4 and later satisfy the requirements required of our software in Section 8. Account Security, but you must confirm these for all systems you use.

• These answers are only as the question relates to Cyrious. Each of these questions is broader than just Cyrious and you must answer them in the context of the entire business operations.
• Cyrious does log activity for users throughout the system, particularly any access to sensitive information. This information provide audit trails for all users, administrative or otherwise, that can be used to recreate access to sensitive information. (Question 1, 2, 3, 4, 5, 6)
• Cyrious does maintain system audit logs. These questions also apply to Windows logging. (Question 7, 8)
• Cyrious does log the following information: User ID, Date and Time, Result, Computer Name,and Type of Event. These questions also apply to Windows logging. (Question 9-14)
• Cyrious does require all computers running Cyrious to be synchronized in time . (Question 15)
• Cyrious does not allow any alteration of the audit trails. Cyrious does store an encrypted checksum to detect any external alteration in the data. (Question 16, 18)
• Cyrious does have provisions to restrict access to view any activities (audit logs) to users with a need for that information. It is up to you to establish a policy that implements this plan. (Question 17)
• Audit trails are backed up when user data is backed up. You should make sure your policy conforms to PCI requirements for backup. (Question 19)
• Cyrious does not use “external facing” technologies unless you are using WebView or Production Terminal. If you are using these, you must ensure that the database logs are not on an external facing server or are copied onto a LAN server. (Question 20)
• Cyrious does detect external changes in the log files and will notify the user of any such detections. (Question 21)
• Cyrious does maintain log files indefinitely. (Question 23)

If you are running Cyrious SMS 8.9pci and Control 4.4, those versions are PCI certified to not store sensitive authentication data after authorization.

• pci_certification_-_trustkeeper_-_viewing_your_results