AheevaCCS and the Payment Card Industry Data Security Standard
|
|
- Eileen Bradley
- 8 years ago
- Views:
Transcription
1 Account Data PCI DSS White Paper by Aheeva, January 2012 AheevaCCS and the Payment Card Industry Data Security Standard Introduction In 2006, the major payment brands including American Express, MasterCard Worldwide, Visa Inc. Discover Financial Services, and JCB International, formed the Payment Card Industry (PCI) Security Standards Council (SSC), a global forum whose mission is the development and management of the PCI Security Standards, including the Data Security Standard (DSS). In March 2011, the council released the document Information Supplement: Protecting Telephone-based Payment Card Data specifically targeting merchants handling credit card data such as call centres. Call centres are often required by regulatory bodies to record and store telephone conversations, thus it becomes mandatory for them to comply with the PCI DSS guidelines. What exactly are the PCI DSS guidelines for Voice Recordings? Simply put, it is a direct violation of PCI DSS Requirement 3.2 to store any sensitive authentication data, including card validation codes and values, after authorization even if encrypted. Therefore, digital audio and video recordings can not store CAV2, CVC2, CVV2 or CID codes after authorization. On the other hand, the primary account number (PAN) can be stored only if made unreadable by encryption or truncation and controlled access. The following table taken from the Information Supplement document, summarizes these guidelines: Cardholder Data Sensitive Authentication Data* Data Element Primary Account Number (PAN) Storage Permitted Yes Render Stored Account Data Unreadable per Requirement 3.4 Yes Cardholder Name Yes No Service Code Yes No Expiration Date Yes No Full Magnetic Stripe Data No Cannot store* CAV2/CVC2/CVV2/ CID No Cannot store* PIN/PIN Block No Cannot store* Page 1
2 In a call centre performing credit card transactions, the customer will most likely give his PAN to the agent by phone. The recordings of these calls must be treated in the same secure way as database storage or simple text files containing cardholder data. PCI DSS allows encryption and storage of the data if the appropriate security guidelines are respected. Access to encryption keys must be granted to the fewest number of custodians possible because those who obtain access will be able to decrypt data. On top of this comes a heavy and strict management process of encryption keys from their generation to their storage, distribution, replacement, and destruction. While technically feasible, this represents a heavy and complex work load and requires specialized resources. Luckily it is possible to eliminate this risk of non-compliancy by taking the audio and video recordings out of the scope of PCI DSS. This can be done by simply avoiding the recording of the PAN. For obvious reasons the same approach must also apply to the card validation codes since they can not be stored under no circumstances, encrypted or not. This is where AheevaCCS comes into play. AheevaCCS and PCI DSS Aheeva adapted its solution for call centres in order to help achieve PCI DSS compliancy by offering two possible ways to avoid having card numbers and validation codes stored in audio and video recordings. The two approaches are not mutually exclusive. Call centre operations can decide to use either one depending on their business need and operations procedures. The first approach mutes the recording and resumes it after some time. The second approach requests customers to enter the numbers using the keypad on their telephones. The following two sections explain in detail the two available options. Muting and resuming recording Muting the recording requires that the agent manually clicks on a button on the StarPhone, the Aheeva s softphone. Before prompting the customer for credit card information, the agent must click on the button. This action triggers an event that halts the audio and video recording for a pre-configured time. Page 2
3 When pressed, the look of the button changes to indicate that the recording has been halted and a countdown timer appears to signal how much time is left before the recording resumes automatically. At any time, while muted, the agent can click again on the button to resume recording the call. AheevaCCS allows the supervisor to configure this functionality per Agent Group. The Supervisor can specify whether the button is enabled on the agents softphone, whether recording resumes automatically or not, and the maximum mute time before an automatic resumption. Page 3
4 Customer DTMF input The second approach consists of having the customer himself entering the PAN and possible verification code directly using the keypad on his telephone. The following shows a step by step of the procedure: The agent expands the list of attached data on his softphone and adds a new variable of type Credit Card, CVV, Expiry Year, or Expiry Month. These four types are already pre-defined in the Aheeva StarPhone so the agent can easily choose the desired one. Page 4
5 Once one of these pre-defined entries is created, a pre-recorded message will get played automatically to the customer prompting him to enter the number by pressing the DTMF keys on his telephone keypad. The playback of this message is optional and can be skipped should the agent ask the customer for the information himself. When the customer enters the DTMF sequence, AheevaCCS detects the keys pressed and automatically populates the Credit Card and CVV fields. The agent does not hear the tones and the sequence entered is masked in the selected field. This keeps the audio and video recordings from containing the information and storing it. Page 5
6 After the customer enters the PAN, the StarPhone validates the sequence entered using the Luhn algorithm and length validation. If successful, then the entry is accepted. If not, the agent will notify the customer who can then try again. Once the customer finishes entering the numbers and they get validated correctly, the agent presses a button to copy the content of the fields to the local clipboard, giving him the possibility to paste the information into a payment processing application without having to hear it, see it or re-enter it. Since the payment processing application is usually a third party application, we have no control over its behaviour and most likely it will display the PAN and verification code in clear. In order to avoid having the numbers recorded in the video after they get copied to the payment application fields, the Aheeva StarPhone automatically sends a control signal to pause the video recording as soon as the agent clicks on the Copy button. The video recording remains paused for a pre-defined time, giving the agent enough time to paste the data and process the transaction. Aheeva Form Builder The Aheeva Form Builder is a friendly tool integrated into the Aheeva Manager that allows the user to build web forms that can pop-up on the agents desktop upon reception of a call. The Aheeva Form Builder offers a new block of elements called Payment Card. This group of elements could be used for capturing the PAN and the verification code. A Payment Card block comprises the following elements: Combo box, listing the types of payment cards : American Express, MasterCard, Visa Primary Account Number, formed of: o Text element: For the first 6 numbers that should be shown o Masked text element: Variable length depending on payment card type o Text element: For the last 4 numbers that should be shown Masked text element for the PIN List box element for the Expiry Month List box element for the Expiry Year Button: Mute/Continue, to pause and continue recording after all the fields are filled Initially all fields are disabled. Upon pressing the Mute button on the form, a control message is sent to an agent s softphone to mute the audio and video recording. Once a confirmation is received that the StarPhone muted the recording, all the fields get enabled. This mechanism guarantees that the agent will not start entering the information while the recordings are still active. Page 6
7 Upon pressing the Resume button, a script validates the PAN entered using the Luhn algorithm and length validation. If successful, all the fields are disabled, and a control message is sent to the StarPhone to resume audio and video recording. The forms created using the Aheeva Form Builder can present the elements to capture the credit card information but they have to be customized to include the code to process the payment transaction with a payment service. By default, the Aheeva forms do not store the sensitive data in the database. The client/user can choose otherwise and customize the form to do so, but he has to be aware of the consequences and implications of doing so as not to violate the PCI DSS Requirement 3.2. Quality Monitoring Using the Aheeva Manager, a web-based configuration and management application, a supervisor can retrieve the recordings list using different criteria. The fetched list shows the number of times a recording had been muted by the agent. The supervisor can then click on that number and a new window pops-up that will show him when that event took place and how long did it last. This allows supervisors to make sure that agents use the new mechanism properly and correctly and do not over use it. Page 7
8 Summary The main objective of PCI DSS is to help merchants put in place the procedures and best practices to minimize the risk of credit card fraud and protect the personal information of cardholders. The scope of work for a call centre to become compliant to PCI DSS is much larger than muting the recordings and encrypting stored data. Often a drastic shift in operations and procedures is necessary along with a serious commitment from all levels in the organization, and the will to invest time and money in order to achieve compliancy. On top of this, the biggest challenge is not in attaining compliancy, but in keeping it year after year. It s expected the biggest challenge won t be in achieving compliancy, but ensuring the standard is maintained. Sooner or later, all merchants processing credit card transactions, especially over the telephone, will be required by the credit card companies to comply with PCI DSS. Aheeva with its AheevaCCS solution had developed a flexible and reliable tool to help call centres take a significant step towards being compliant with the PCI DSS requirements. Aheeva is committed to always offering the best possible solution to ensure the confidentiality and security of sensitive data. The culture and values of Aheeva ensure that the AheevaCCS will continue evolving and uncover better ways to make it the solution of choice for call centres seeking compliancy. Page 8
Standard: PCI Data Security Standard (PCI DSS) Version: 2.0 Date: March 2011. Information Supplement: Protecting Telephone-based Payment Card Data
Standard: PCI Data Security Standard (PCI DSS) Version: 2.0 Date: March 2011 Information Supplement: Protecting Telephone-based Payment Card Data Table of Contents Executive Summary 3 Clarification of
More informationInformation Sheet. PCI DSS Overview
The payment card industry (PCI) protects cardholder data through technical and operations standard set by its Council. Compliance with PCI standards is mandatory. It is enforced by the major payment card
More informationPCI DSS FAQ. The twelve requirements of the PCI DSS are defined as follows:
What is PCI DSS? PCI DSS is an acronym for Payment Card Industry Data Security Standards. PCI DSS is a global initiative intent on securing credit and banking transactions by merchants & service providers
More informationWhite Paper On. PCI DSS Compliance And Voice Recording Implications
White Paper On PCI DSS Compliance And Voice Recording Implications PCI DSS within the UK is becoming a hot topic of conversation, with many contradictions and confusions being issued by suppliers and professionals
More informationWhite paper. How to take your contact centre out of scope for PCI DSS. Reducing cost and risk in credit card transactions for contact centres
White paper How to take your contact centre out of scope for PCI DSS Executive summary With 77 per cent of UK companies admitting to a security breach (Source: The Ponemon Institute, 2009), and up to 97
More informationCredit Card Handling Security Standards
Credit Card Handling Security Standards Overview This document is intended to provide guidance to merchants (colleges, departments, auxiliary organizations or individuals) regarding the processing of charges
More informationKey Steps to Meeting PCI DSS 2.0 Requirements Using Sensitive Data Discovery and Masking
Key Steps to Meeting PCI DSS 2.0 Requirements Using Sensitive Data Discovery and Masking SUMMARY The Payment Card Industry Data Security Standard (PCI DSS) defines 12 high-level security requirements directed
More informationSafe and Sound Processing Telephone Payments Securely. A white paper from Barclaycard and Visa Europe leading the way in secure payments April 2015
Safe and Sound Processing Telephone Payments Securely A white paper from Barclaycard and Visa Europe leading the way in secure payments April 2015 Executive summary The following information and guidance
More informationPolicy Title: Payment Cards Policy Effective Date: 5/5/2010. Policy Number: FA-PO-1214 Date of Last Revision: 11/5/2014
Policy Title: Effective Date: 5/5/2010 Policy Number: FA-PO-1214 Date of Last Revision: 11/5/2014 Oversight Department: Financial Services Next Review Date: 10/1/2016 1. PURPOSE The for Radford University
More informationGuidance Notes PCI DSS Compliance as it relates to Call Recording
Guidance Notes PCI DSS Compliance as it relates to Call Recording Published by DMA Contact Centres & Telemarketing Council First edition Contents Disclaimer...2 1. Background...3 2. The fundamental storage
More informationInformation Technology
Credit Card Handling Security Standards Overview Information Technology This document is intended to provide guidance to merchants (colleges, departments, organizations or individuals) regarding the processing
More informationSection 3.9 PCI DSS Information Security Policy Issued: June 2016 Replaces: January 2015
Section 3.9 PCI DSS Information Security Policy Issued: June 2016 Replaces: January 2015 I. PURPOSE The purpose of this policy is to establish guidelines for processing charges on Payment Cards to protect
More informationPCI Policies 2011. Appalachian State University
PCI Policies 2011 Appalachian State University Table of Contents Section 1: State and Contractual Requirements Governing Campus Credit Cards A. Cash Collection Point Approval for Departments B. State Requirements
More informationHow to Take your Contact Centre Out of Scope for PCI DSS. Reducing Cost and Risk in Credit Card Transactions for Contact Centres
How to Take your Contact Centre Out of Scope for PCI DSS Reducing Cost and Risk in Credit Card Transactions for Contact Centres 1 2 Contents 4 Executive Summary 6 PCI DSS Background 8 PCI DSS What s Involved
More informationPCI Compliance. Reducing cost & risk in Credit Card Transactions for Contact Centres V1.0
PCI Compliance Reducing cost & risk in Credit Card Transactions for Contact Centres V1.0 Contents Executive Summary 3 PCI DSS and the battle against card fraud Introduction 4 PCI DSS Requirements PCI DSS
More informationPCI Training for Retail Jamboree Staff Volunteers. Securing Cardholder Data
PCI Training for Retail Jamboree Staff Volunteers Securing Cardholder Data Securing Cardholder Data Introduction This PowerPoint presentation is designed to educate Retail Jamboree Staff volunteers on
More informationSteps for staying PCI DSS compliant Visa Account Information Security Guide October 2009
Steps for staying PCI DSS compliant Visa Account Information Security Guide October 2009 The guide describes how you can make sure your business does not store sensitive cardholder data Contents 1 Contents
More informationConformance of Avaya Aura Workforce Optimization Quality Monitoring Recording Solution with the PCI Data Security Standard
Conformance of Avaya Aura Workforce Optimization Quality Monitoring Recording Solution with the PCI Data Security Standard August 2014 Table of Contents Introduction... 1 PCI Data Security Standard...
More informationA MERCHANTS GUIDE TO THE PAYMENT APPLICATION DATA SECURITY STANDARD (PA-DSS)
A MERCHANTS GUIDE TO THE PAYMENT APPLICATION DATA SECURITY STANDARD (PA-DSS) The mandatory guide for storing, processing or transmitting cardholder information Overview and applicability Any application
More informationAppendix 1 Payment Card Industry Data Security Standards Program
Appendix 1 Payment Card Industry Data Security Standards Program PCI security standards are technical and operational requirements set by the Payment Card Industry Security Standards Council to protect
More informationNeed to be PCI DSS compliant and reduce the risk of fraud?
Need to be PCI DSS compliant and reduce the risk of fraud? NCR Security lessens your PCI compliance burden and protects the integrity of your network An NCR White Paper Experience a new world of interaction
More informationTREASURER S OFFICE ADMINISTRATIVE STANDARDS FOR THE TREASURER S FISCAL PROCEDURE No. 08-01 MERCHANT DEBIT AND CREDIT CARD RECEIPTS
TREASURER S OFFICE ADMINISTRATIVE STANDARDS FOR THE TREASURER S FISCAL PROCEDURE No. 08-01 MERCHANT DEBIT AND CREDIT CARD RECEIPTS 1. Introduction Debit and Credit Card Receipt Standards apply to the administration
More informationFinance & Ecommerce Systems
Finance & Ecommerce Systems Prepared by: Colette Elson Issued: November 2013 November 2013 Page 1 Contents Page 1 Introduction 2 Responsibility 3 The PCI Data Security Standard 4 PCI DSS Requirements 5
More informationHow To Complete A Pci Ds Self Assessment Questionnaire
Department PCI Self-Assessment Questionnaire Version 1.1 2009 Attestation of Compliance Instructions for Submission This Department PCI Self-Assessment Questionnaire has been developed as an assessment
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.0 February 2014 Section 1: Assessment Information Instructions for Submission
More informationPayment Cardholder Data Handling Procedures (required to accept any credit card payments)
Payment Cardholder Data Handling Procedures (required to accept any credit card payments) Introduction: The Procedures that follow will allow the University to be in compliance with the Payment Card Industry
More informationINFORMATION SECURITY POLICY. Policy for Credit Card Acceptance to Conduct College Business
DELAWARE COLLEGE OF ART AND DESIGN 600 N MARKET ST WILMINGTON DELAWARE 19801 302.622.8000 INFORMATION SECURITY POLICY including Policy for Credit Card Acceptance to Conduct College Business stuff\policies\security_information_policy_with_credit_card_acceptance.doc
More informationUniversity Policy Accepting and Handling Payment Cards to Conduct University Business
BROWN UNIVERSITY University Policy Accepting and Handling Payment Cards to Conduct University Business Table of Contents Purpose... 2 Scope... 2 Authorization... 2 Establishing a new account... 2 Policy
More informationPCI Compliance : What does this mean for the Australian Market Place? Nov 2007
Sense of Security Pty Ltd (ABN 14 098 237 908) 306, 66 King St Sydney NSW 2000 Australia Tel: +61 (0)2 9290 4444 Fax: +61 (0)2 9290 4455 info@senseofsecurity.com.au PCI Compliance : What does this mean
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Self-Assessment Questionnaire D Service Providers For use with PCI DSS Version 3.1 Revision 1.1 July 2015 Section 1: Assessment
More informationPayment Card Industry Data Security Standard (PCI DSS)
Payment Card Industry Data Security Standard (PCI DSS) What is PCI SSC? A 12 year old independent industry standards body providing oversight of the development and management of Payment Card Industry
More informationPayment Card Industry Data Security Standards
Payment Card Industry Data Security Standards PCI DSS Rhonda Chorney Manager, Revenue Capital & General Accounting Today s Agenda 1. What is PCI DSS? 2. Where are we today? 3. Why is compliance so important?
More informationCredit Card Security
Credit Card Security Created 16 Apr 2014 Revised 16 Apr 2014 Reviewed 16 Apr 2014 Purpose This policy is intended to ensure customer personal information, particularly credit card information and primary
More informationTERMINAL CONTROL MEASURES
UCR Cashiering & Payment Card Services TERMINAL CONTROL MEASURES Instructions: Upon completion, please sign and return to cashandmerchant@ucr.edu when requesting a stand-alone dial up terminal. The University
More informationHow To Program A Credit Card Terminal To Be A Pca Compliant (Cpo) Or Not (Pca) Compliant (Dns) (Cisp) (Dhs) (Pci) (Susu) (Usu/
Integrating Credit Card Processing CLEAR Objectives Non-Compatible Terminals Compatible Terminals Common Error Messages Steps on how to program a credit terminal PCI Compliant Businesses Credit Card processing
More information2.0 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS (PCI-DSS)
CSU, Chico Credit Card Handling Security Standard Effective Date: July 28, 2015 1.0 INTRODUCTION This standard provides guidance to ensure that credit card acceptance and ecommerce processes comply with
More informationPCI Compliance Information Packet for Volunteers - Credit Card Processing for Product Sales and Online Camp / Event Registration
PCI Compliance Information Packet for Volunteers - Credit Card Processing for Product Sales and Online Camp / Event Registration Table of Contents Introduction to Credit Card Processing for Product Sales
More informationCredit Card Processing Overview
CardControl 3.0 Credit Card Processing Overview Overview Credit card processing is a very complex and important system for anyone that sells goods. This guide will hopefully help educate and inform new
More informationPayment Card Industry Data Security Standard
Payment Card Industry Data Security Standard Introduction Purpose Audience Implications Sensitive Digital Data Management In an effort to protect credit card information from unauthorized access, disclosure
More informationP R O G R E S S I V E S O L U T I O N S
PCI DSS: PCI DSS is a set of technical and operational mandates designed to ensure that all organizations that process, store or transmit credit card information maintain a secure environment and safeguard
More informationPLACE GROUP UK LONDON STUDENT HOUSING GROUP PAYMENT CARD INDUSTRY DATA SECURITY STANDARD COMPLIANCE STATEMENT PCI DSS (09) VERSION: 2009PCIDSSP4S01
PLACE GROUP UK LONDON STUDENT HOUSING GROUP PAYMENT CARD INDUSTRY DATA SECURITY STANDARD COMPLIANCE STATEMENT PCI DSS (09) VERSION: 2009PCIDSSP4S01 Information updated: 21 October 2012 SAFEGUARDING CARDHOLDER
More informationPCI Data Security Standards. Presented by Pat Bergamo for the NJTC February 6, 2014
PCI Data Security Standards Presented by Pat Bergamo for the NJTC February 6, 2014 Introduction 3/3/2014 2 Your Speaker Patrick Bergamo, CISSP Director of Information Security & Delivery Delta Corporate
More informationPayment Card Industry (PCI) Data Security Standard. Attestation of Compliance for Self-Assessment Questionnaire C-VT. Version 2.0
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Self-Assessment Questionnaire C-VT Version 2.0 October 2010 Attestation of Compliance, SAQ C-VT Instructions for Submission
More informationFrequently Asked Questions
PCI Compliance Frequently Asked Questions Table of Content GENERAL INFORMATION... 2 PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS)...2 Are all merchants and service providers required to comply
More informationPCI General Policy. Effective Date: August 2008. Approval: December 17, 2015. Maintenance of Policy: Office of Student Accounts REFERENCE DOCUMENTS:
Effective Date: August 2008 Approval: December 17, 2015 PCI General Policy Maintenance of Policy: Office of Student Accounts PURPOSE: To protect against the exposure and possible theft of account and personal
More informationIntro to PCI Compliance
Intro to PCI Compliance And the role Stone Edge V7.1 plays in helping you achieve that goal Monsoon Commerce. All rights reserved. What is PCI? PCI stands for Payment Card Industry In 2006, major financial
More informationTHE ROLE OF THE CONTACT CENTER IN PCI COMPLIANCE
THE ROLE OF THE CONTACT CENTER IN PCI COMPLIANCE ENSURING SAFE COMMERCE www.nice.com TABLE OF CONTENTS THE IMPORTANCE OF PCI COMPLIANCE... UNDERSTANDING THE KEY REQUIREMENT... PRIVACY CONTROL: DESIGNS
More informationWhat are the PCI DSS requirements? PCI DSS comprises twelve requirements, often referred to as the digital dozen. These define the need to:
What is the PCI standards council? The Payment Card Industry Standards Council is an institution set-up by American Express, Discover Financial Services, JCB, MasterCard Worldwide and Visa International
More informationCardControl. Credit Card Processing 101. Overview. Contents
CardControl Credit Card Processing 101 Overview Credit card processing is a very complex and important system for anyone that sells goods. This guide will hopefully help educate and inform new and old
More informationComplying with PCI DSS
Complying with PCI DSS Table of Contents Complying with the New PCI DSS Rulings 1 Audio and DTMF Tone Data 2 Agent Screen Data 2 Appendix A 3 Complying with the New PCI DSS Rulings The Payment Card Industry
More informationYour Compliance Classification Level and What it Means
General Information What are the Payment Card Industry (PCI) Data Security Standards? The PCI Data Security Standards represents a common set of industry tools and measurements to help ensure the safe
More informationPCI Data Security and Classification Standards Summary
PCI Data Security and Classification Standards Summary Data security should be a key component of all system policies and practices related to payment acceptance and transaction processing. As customers
More informationUCSD Credit Card Processing Policy & Procedure
UCSD Credit Card Processing Policy & Procedure The Payment Process UCSD accepts Visa, MasterCard, American Express and Discover credit cards. We perform credit transactions only, no debit sales with cash
More informationCREDIT CARD PROCESSING & SECURITY POLICY
FINANCE AND TREASURY POLICIES AND PROCEDURES E071 CREDIT CARD PROCESSING & SECURITY POLICY PURPOSE The purpose of this policy is to establish guidelines for processing charges/credits on Credit Cards to
More informationPayment Card Industry Data Security Standards (PCI-DSS) Guide for Contact Center Managers
Payment Card Industry Data Security Standards (PCI-DSS) January 2012 Reprinted for Table of Contents Executive Summary... 1 What is PCI-DSS?... 1 Violation Notification Requirements... 7 Is PCI-DSS a Law?...
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Standard Attestation of Compliance for Self-Assessment Questionnaire D Service Providers Version 3.1 April 2015 Section 1: Assessment Information Instructions for Submission
More information6-8065 Payment Card Industry Compliance
0 0 0 Yosemite Community College District Policies and Administrative Procedures No. -0 Policy -0 Payment Card Industry Compliance Yosemite Community College District will comply with the Payment Card
More informationFinance Office. Card Handling Policy
Finance Office Card Handling Policy Prepared by: Lyndsay Brown Issued: November 2012 1 Contents Page 1 Introduction 3 2 Responsibility 3 3 The PCI Data Security Standard 3 4 PCI DSS Requirements 4 5 Receiving/
More informationCOLUMBUS STATE COMMUNITY COLLEGE POLICY AND PROCEDURES MANUAL
PAYMENT CARD INDUSTRY COMPLIANCE (PCI) Effective June 1, 2011 Page 1 of 6 (1) Definitions a. Payment Card Industry Data Security Standards (PCI-DSS): A set of standards established by the Payment Card
More informationCOLORADO STATE UNIVERSITY Financial Procedure Statements FPI 6-6
1. Procedure Title: PCI Compliance Program COLORADO STATE UNIVERSITY Financial Procedure Statements FPI 6-6 2. Procedure Purpose and Effect: All Colorado State University departments that accept credit/debit
More informationPCI PA-DSS Requirements. For hardware vendors
PCI PA-DSS Requirements For hardware vendors PCI security services UL's streamlined PCI PA-DSS certification services get your product to market faster. UL is world leader in advancing safety. Through
More informationPayment Card Industry (PCI) Payment Application Data Security Standard
Payment Card Industry (PCI) Payment Application Data Security Standard Requirements and Security Assessment Procedures Version 2.0 October 2010 Document Changes Date Version Description Pages October 1,
More informationAdyen PCI DSS 3.0 Compliance Guide
Adyen PCI DSS 3.0 Compliance Guide February 2015 Page 1 2015 Adyen BV www.adyen.com Disclaimer: This document is for guidance purposes only. Adyen does not accept responsibility for any inaccuracies. Merchants
More informationPolicies and Procedures
Policies and Procedures Provided by PROGuard The following are policies and procedures which need to be enforced to ensure PCI DSS compliance. In order to answer yes to the questions and pass the SAQ,
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire B and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire B and Attestation of Compliance Merchants with Only Imprint Machines or Only Standalone, Dial-out Terminals Electronic Cardholder
More informationWhite Paper. Managing Risk to Sensitive Data with SecureSphere
Managing Risk to Sensitive Data with SecureSphere White Paper Sensitive information is typically scattered across heterogeneous systems throughout various physical locations around the globe. The rate
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A and Attestation of Compliance Card-not-present Merchants, All Cardholder Data Functions Fully Outsourced Version 3.0 February
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire B and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire B and Attestation of Compliance Imprint Machines or Stand-alone Dial-out Terminals Only, no Electronic Cardholder Data Storage
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance All other SAQ-Eligible Merchants and Service Providers Version 2.0 October 2010 Document
More informationPayment Card Industry Data Security Standard PCI DSS
Payment Card Industry Data Security Standard PCI DSS What is PCI DSS? Requirements developed by the five card brands: VISA, Mastercard, AMEX, JCB and Discover. Their aim was to put together a common set
More informationJosiah Wilkinson Internal Security Assessor. Nationwide
Josiah Wilkinson Internal Security Assessor Nationwide Payment Card Industry Overview PCI Governance/Enforcement Agenda PCI Data Security Standard Penalties for Non-Compliance Keys to Compliance Challenges
More information2.1.2 CARDHOLDER DATA SECURITY
University of Oxford Finance Division FINANCIAL POLICY 2.1.2 CARDHOLDER DATA SECURITY Date: 21 March 2013 Version: 2.1.2 Status: Approved Author: Simon Blee Bridget Midwinter TABLE OF CONTENTS Page EXECUTIVE
More informationAppendix 1 - Credit Card Security Incident Response Plan
Appendix 1 - Credit Card Security Incident Response Plan 1 Contents Revisions/Approvals... i Purpose... 2 Scope/Applicability... 2 Authority... 2 Security Incident Response Team... 2 Procedures... 3 Incident
More informationAttestation of Compliance for Onsite Assessments Service Providers
Attestation of Compliance Service Providers Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 2.0 October 2010 Instructions for
More informationVersion 15.3 (October 2009)
Copyright 2008-2010 Software Technology, Inc. 1621 Cushman Drive Lincoln, NE 68512 (402) 423-1440 www.tabs3.com Portions copyright Microsoft Corporation Tabs3, PracticeMaster, and the pinwheel symbol (
More informationGRINNELL COLLEGE CREDIT CARD PROCESSING AND SECURITY POLICY
GRINNELL COLLEGE CREDIT CARD PROCESSING AND SECURITY POLICY PURPOSE The Payment Card Industry Data Security Standard was established by the credit card industry in response to an increase in identify theft
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.0 February 2014 Section 1: Assessment Information Instructions for Submission
More informationHow To Comply With The Pci Ds.S.A.S
PCI Compliance and the Data Security Standards Introduction The PCI DSS, a set of comprehensive requirements for enhancing payment account data security, was developed by the founding payment brands of
More informationUNL PAYMENT CARD POLICY AND PROCEDURES. Table of Contents
UNL PAYMENT CARD POLICY AND PROCEDURES Table of Contents Payment Card Merchant Security Standards Policy and Procedures... 2 Introduction... 4 Payment Card Industry Data Security Standard... 4 Definitions...
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.0 February 2014 Section 1: Assessment Information Instructions for Submission
More informationThis appendix is a supplement to the Local Government Information Security: Getting Started Guide, a non-technical reference essential for elected
This appendix is a supplement to the Local Government Information Security: Getting Started Guide, a non-technical reference essential for elected officials, administrative officials and business managers.
More informationDalPay Internet Billing. Technical Integration Overview
DalPay Internet Billing Technical Integration Overview Version 1.3 Last revision: 01/07/2011 Page 1 of 10 Version 1.3 Last revision: 01/07/2011 Page 2 of 10 REVISION HISTORY... 4 INTRODUCTION... 5 DALPAY
More informationWhy Is Compliance with PCI DSS Important?
Why Is Compliance with PCI DSS Important? The members of PCI Security Standards Council (American Express, Discover, JCB, MasterCard, and Visa) continually monitor cases of account data compromise. These
More informationPCI PA - DSS. Point XSA Implementation Guide. Atos Worldline Banksys XENTA SA. Version 1.00
PCI PA - DSS Point XSA Implementation Guide Atos Worldline Banksys XENTA SA Version 1.00 POINT TRANSACTION SYSTEMS AB Box 92031, 120 06 Stockholm, Tel. +46 8 566 287 00 www.point.se Page number 2 (16)
More information11/24/2014. PCI Compliance: Major Changes in e-quantum/quantum Net
PCI Compliance: Major Changes in e-quantum/quantum Net 1 Credit Card Fraud By some estimates, credit card fraud will cost legitimates businesses hundreds of billions of dollars world wide this year. If
More informationFraud Protection, You and Your Bank
Fraud Protection, You and Your Bank Maximize your chances to minimize your losses Presentation for Missouri GFOA April 2011 By: Terry Endres, VP, Government Treasury Solutions Phone: 314-466-6774 Terry.m.endres@baml.com
More informationPayment Card Industry Data Security Standard (PCI DSS) Q & A November 6, 2008
Payment Card Industry Data Security Standard (PCI DSS) Q & A November 6, 2008 What is the PCI DSS? And what do the acronyms CISP, SDP, DSOP and DISC stand for? The PCI DSS is a set of comprehensive requirements
More informationBecoming PCI Compliant
Becoming PCI Compliant Jason Brown - brownj52@michigan.gov Enterprise Security Architect Enterprise Architecture Department of Technology, Management and Budget State of Michigan @jasonbrown17 History
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.0 February 2014 Section 1: Assessment Information Instructions for Submission
More informationSecurity standards PCI-DSS, HIPAA, FISMA, ISO 27001. End Point Corporation, Jon Jensen, 2014-07-11
Security standards PCI-DSS, HIPAA, FISMA, ISO 27001 End Point Corporation, Jon Jensen, 2014-07-11 PCI DSS Payment Card Industry Data Security Standard There are other PCI standards beside DSS but this
More informationReferences: County Policy Manual- Credit Card Payments; Vendor Remote Access Request Form
Procedure Credit Card Processing Vendor Evaluation, Contracting, and Management Last Update: January 19, 2016 References: County Policy Manual- Credit Card Payments; Vendor Remote Access Request Form Purpose:
More informationPayment Card Industry (PCI) Policy Manual. Network and Computer Services
Payment Card Industry (PCI) Policy Manual Network and Computer Services Forward This policy manual outlines acceptable use Black Hills State University (BHSU) or University herein, Information Technology
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.1 April 2015 Section 1: Assessment Information Instructions for Submission
More informationPOLICY NAME : MERCHANT (PCI) POLICY AND PROCEDURES ACCEPTING CREDIT/DEBIT CARD PAYMENTS
Publication Date 2009-08-11 Issued by: Financial Services Chief Information Officer Revision V 1.0 POLICY NAME : MERCHANT (PCI) POLICY AND PROCEDURES ACCEPTING CREDIT/DEBIT CARD PAYMENTS Overview: There
More informationFORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY
FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY Page 1 of 6 Summary The Payment Card Industry Data Security Standard (PCI DSS), a set of comprehensive requirements for enhancing payment account
More informationNew York University University Policies
New York University University Policies Title: Payment Card Industry Data Security Standard Policy Effective Date: April 11, 2012 Supersedes: N/A Issuing Authority: Executive Vice President for Finance
More informationAIS Webinar. Payment Application Security. Hap Huynh Business Leader Visa Inc. 1 April 2009
AIS Webinar Payment Application Security Hap Huynh Business Leader Visa Inc. 1 April 2009 1 Agenda Security Environment Payment Application Security Overview Questions and Comments Payment Application
More informationVaronis Systems & The Payment Card Industry Data Security Standard (PCI DSS)
CONTENTS OF THIS WHITE PAPER Overview... 1 Background... 1 Who Needs To Comply... 1 What Is Considered Sensitive Data... 2 What Are the Costs/Risks of Non-Compliance... 2 How Varonis Helps With PCI Compliance...
More informationThoughts on PCI DSS 3.0. September, 2014
Thoughts on PCI DSS 3.0 September, 2014 Speaker Today Jeff Sanchez is a Managing Director in Protiviti s Los Angeles office. He joined Protiviti in 2002 after spending 10 years with Arthur Andersen s Technology
More informationGuide to Data Field Encryption
Guide to Data Field Encryption Contents Introduction 2 Common Concepts and Glossary 3 Encryption 3 Data Field Encryption 3 Cryptography 3 Keys and Key Management 5 Secure Cryptographic Device 7 Considerations
More information