1 End User Device Security 

1.1 Operating System and Browser 

Keep operating systems up to date on all recommended patches. The same applies to the internet browsers of the users. TIS support can provide you a list of supported browsers. 

1.2 Computer 

Do not use computers in public areas and third parties (i.e., Internet cafes, airports, etc.). Use computers provided by your company. 

1.3 Firewall 

Utilize firewall and intrusion detection services as an additional security layer for blocking and identifying potential online attacks. 

1.4 Anti-Virus 

Install and use up-to-date antivirus software (including anti-spam and anti-spyware programs) to prevent, detect and remove malware of all kinds. 

2 Authentication and Login 

2.1 TIS Internet Address and Website 

Use the TIS services only through the TIS website (www.tispayments.com) and never through links displayed on other websites, search engines or in e-mail messages. 

2.2 IP Address Filtering 

Use IP filtering to restrict the login from unwanted IP addresses. The settings are defined in the Administration Area under Security Settings. 

Exception: CashOptix does not IP filtering to restrict the login from unwanted IP addresses 

2.3 Login 

Ensure that you follow the correct procedure when logging on to and off from TIS. Particularly when logging off, select "Logout" instead of directly closing the browser window. 

2.4 Session Timeout 

It is recommended to set a user session timeout of max. 5 minutes in the Administration Area under Security Settings. The user session timeout defines how long a session is active if no user interaction occurs. 

Exception: CashOptix does not support the option to set a user session timeout, 

2.5 User Passwords 

Use strong passwords. Discourage password-sharing among users. Do not store your passwords on your laptop, instead use a password vault. The lifetime should be set at the administration area to a maximum of 30 days. In case TIS’ password policy does not meet your security requirements, we encourage customers to activate single sign-on using your own identity provider (item 2.9). 

Exception: It is not possible to set a password expiration period in CashOptix, we encourage customers to activate single sign-on using your own identity provider (item 2.9). 

2.6 Two-Factor Authentication 

In general, any user of TIS should use two-factor authentication (via TIS token or your own, via single sign-on – please refer to item 2.9). For user roles such as Company Administrators, Approvers and Administrators two-factor authentication is mandatory. 

Exception: CashOptix doesn’t support two-factor authentication 

2.7 Hardware Token 

TIS delivers to its customers a one-time-password token for two-factor authentication upon request. Make sure that the receiver of the tokens confirms with TIS the delivery of the tokens. Only when confirmed the tokens are assignable to users. After the activation at TIS the tokens are assigned to users in the User Management via its serial numbers. 

Exception: CashOptix doesn’t support hardware tokens 

2.8 Software Token 

TIS provides an option to use software tokens. For more details, please contact the respective Customer Success representative. 

Exception: CashOptix doesn’t support software tokens 

2.9 Single-Sign-On 

As an alternative to the standard login procedure via user / password and the TIS hardware token, TIS recommends using TIS’ SAML2.0 based single-sign-on authentication mechanism. For more information, please contact TIS support. 

3 User Management and Authorization 

3.1 4-eyes Principle 

Make sure that any approval process is properly secured with a 4-eyes principle. Avoid single approval rights for productive bank accounts. The 4-eyes principle should be enabled for administration area after go-live. Any changes to master data should be covered by a 4-eyes principle as well. 

3.2 User Groups and Permissions 

With TIS’ user group and permission concept you can customize for each user group the exact set of assigned read, create, update and delete permissions for any master data or transactional object. TIS recommends assigning to each user group only the minimum required permissions, always considering the least privilege and role-based access control principles. Users associated to specific organization entities should only be granted permissions for objects within the scope of this entity. 

3.3 Workflows 

The functionality to take over workflows should be disabled before go-live. 

4 Secure Store 

4.1 Tenant Password 

The Tenant Password is used to encrypt sensitive customer data such as banking access parameters. Save the password at a secure place and choose a complex secure password. This password cannot be recovered by TIS. In case of loss, it will require re-initialization of all bank connections. 

5 Information Exchange and Data Management 

5.1 E-Mail 

As a general rule, TIS does not send out any e-mails asking their customers to disclose confidential access and transaction data such as usernames, passwords, or other confidential information etc. 

5.2 Disclosure of Information 

Do not send company confidential information or personal data to any employee of TIS, neither through e-mail nor via the support portal. 

5.3 Excel Import/Export 

Disable the Excel-Import / Export functionality before going live to avoid non-governed master data management processes. 

5.4 Test-System 

Do not use productive data in the TIS test systems. Make sure that your ERP test system is connected to the TIS test system. Never process productive payments on the test systems. 

6 Data Privacy 

If your company operates in or collects and processes data from citizens of countries where data protection laws regulate the careful handling of personal information, pay special attention to where you store such data within the TIS application. Do not misuse general text fields, such as comment or title columns, for personal data. Keep track of where you put such information and implement the necessary processes in your company to handle these occurrences accordingly. This includes (but may not be limited to) the following areas: 

6.1 Custom Fields 

Customers can configure custom fields at various company levels in the application in order to store additional information together with most master data. TIS is not aware of the nature of the content entered into such fields. Keep the personal data stored in such fields to a minimum, especially on higher levels where a larger group of people has access to it. Enter such information only in places where it is expected, set permissions accordingly, and keep track of these within your company. You are responsible for correcting, blocking, and deleting such data as well as providing information about it if necessary. Please note that the General Information History may also contain an audit trail of custom field values. 

6.2 Attachments 

Similar to custom fields, attachments can be uploaded at different locations within the application. Again, TIS is not aware of the nature of such content and thus cannot automatically identify personal information within attachments. Keep personal data within attachments to a minimum and keep track of where you upload such documents. It is your responsibility to correct, block, and delete these files as well as provide information about their existence if requested. Please note that the Attachment History also contains references to uploaded documents even after they were deleted. Remove entries from this audit trail on demand. For providing links to payments and/or files, keep track what links you provide. It is your responsibility to provide links only to secured sites and documents. 

Advise all employees that personal attachments uploaded to their user profile have to be managed by the individual user and must not contain personal data for which no consent was given. This also includes a user's profile picture. 

6.3 Reports/Exports 

Delete reports and data export files generated in the background from the Jobs view. These documents are accessible as result of finished background jobs and may contain personal information, depending on the execution context. 

6.4 Templates 

Do not include personal information within Excel report or Word templates. 

6.5 Certification and PGP Keys 

Do not store personal data in the details of security certificates and cryptographic keys. If issuer or user ID fields contain such information, remove or replace it as legally required. 

7 Data Integrity and Process Monitoring 

7.1 Payment Processing 

When a payment file is uploaded to the TIS platform the file is stored in the Temporary Storage before it is processed by the Bank Transaction Manager Application. If a payment file cannot be processed (e.g., because of syntactical or semantic errors) the payment file stays in the Temporary Storage in status error including an error message. TIS recommends customers to monitor payment files in the Temporary Storage Monitor within the Administration area of the TIS Platform and ensure that payments are processed in time. 

The protection of payments from unauthorized manipulation is ensured by signing the payment with a customer specific key within the Bank Transaction Manager application. Payments are not processed if the signature of a payment is not valid. It is strongly recommended to verify the correctness and validity of the data before approval. It is recommended also to enable ‘Signing with token’ for additional security upon approval (subject to license). The status of the payment indicates if the transmission is successful. This can be verified in the Bank Link Configuration in the Administration area of the TIS Platform as well. TIS strongly recommends checking the status especially for time critical payments to ensure payments are transmitted on time. 

7.2 Payment Status Report 

Payment status reports, which are delivered by the bank, can be downloaded and processed by the TIS Platform. a successful download can be monitored either at the Bank Link Configuration or on the payment itself where the status of the payment is updated accordingly. The pull status shows all successful and failed download operations at the bank. The files are stored in the Temporary Storage before they are processed by the Bank Transaction Manager application. 

7.3 Bank Account Statement Processing 

Bank account statements are downloaded by the TIS application from the respective bank and stored in a canonical data model within the TIS application. Successful and failed downloads of account statements can be monitored in the Bank Link Configuration in the Administration Area of the TIS Platform. The bank account statement files are visible in the Temporary Storage before they are processed by the Bank Statement Manager application. If a bank account statement cannot be processed (e.g., because of syntactical or semantic errors) the account statement file will stay in the Temporary Storage with an error status. TIS recommends monitoring the status in both areas to ensure account statements are processed on time. 

Customers can connect client systems to automatically download bank account statement files from the TIS Platform. In those cases, customers can monitor the successful download at the Client System Configuration in the Administration Area of the TIS Platform. 

7.4 File Downloads from TIS Platform 

TIS provides an Application Programming Interface (API) which allows to download files such as bank account statements. When customers use their own implementation to connect to TIS, the download must be confirmed by the client system. Customers must ensure that the file is correctly downloaded to the target location before providing confirmation to TIS. TIS Agent and SAP ERP Add-on already have this process implemented.