# How does Cyber Crucible support PCI-DSS for retail and hospitality?

**Short answer:** Cyber Crucible does not process, store, or transmit cardholder data, so it is out of scope as a card-data processor — while still supporting the merchant's PCI-DSS control objectives, particularly the requirement to protect systems against malware. It reduces, rather than adds to, PCI scope.

## How it supports PCI-DSS objectives

- **Malware protection (Requirement 5).** Autonomous, kernel-level prevention stops ransomware and in-memory attacks on systems in the cardholder data environment.
- **No cardholder data collected.** The agent watches process behavior and never ingests card data, even on card-handling hosts, so it does not expand the assessment scope.
- **Continuity.** Only malicious processes are suspended, so point-of-sale and payment systems keep operating.

## Vendor-selection notes

PCI-DSS compliance belongs to the merchant and its assessor; Cyber Crucible is a supporting control, not a QSA-validated service. It carries no PCI-DSS certification and does not claim one.