Implementation Guide for PCI Compliance. Microsoft Dynamics AX 2012 R3

Transcription

1 Implementatin Guide fr PCI Cmpliance Micrsft Dynamics AX 2012 R3 April 2014

2 Micrsft Dynamics is a line f integrated, adaptable business management slutins that enables yu and yur peple t make business decisins with greater cnfidence. Micrsft Dynamics wrks like and with familiar Micrsft sftware, autmating and streamlining financial, custmer relatinship and supply chain prcesses in a way that helps yu drive business success. U.S. and Canada Tll Free Wrldwide This dcument is prvided "as-is". Infrmatin and views expressed in this dcument, including URL and ther Internet Web site references, may change withut ntice. Yu bear the risk f using it. Sme examples depicted herein are prvided fr illustratin nly and are fictitius. N real assciatin r cnnectin is intended r shuld be inferred. This dcument des nt prvide yu with any legal rights t any intellectual prperty in any Micrsft prduct. Yu may cpy and use this dcument fr yur internal, reference purpses. Cpyright 2014 Micrsft. All rights reserved. Micrsft, Micrsft Dynamics, SQL Server, Windws, Windws Server, Windws Vista, and the Micrsft Dynamics Lg are trademarks f the Micrsft grup f cmpanies. All ther trademarks are prperty f their respective wners.

3 Table f cntents Intrductin... 1 Get the latest release f this guide... 1 Fr mre infrmatin... 1 Part 1: Setup... 2 Install the sftware... 2 All cmputers: Maintain security... 2 All cmputers: Prepare fr mnitring f event lgs... 2 All cmputers: Set up auditing f file access, bject access, and audit plicy changes... 2 Enable auditing f file access, bject access, and audit-plicy changes... 3 Audit access t system flders and files... 3 Required services and prtcls... 4 Cmmunicatin and database cmputers: Open the firewall... 5 Open Windws Firewall n Windws 7, Windws 8, Windws Server 2008, r Windws Server Open Windws Firewall n Windws Embedded POSReady At the head ffice: Set up the passwrd plicy... 7 At the head ffice: Set up database lgging... 7 At the head ffice: Enable SQL Server trace lgging... 9 Obtain a Payment Services fr Micrsft Dynamics ERP subscriptin... 9 Partner: In Partner Prtal, create a Payment Services accunt fr the retailer Retailer: In Custmer Prtal, set up a merchant accunt with a payment prvider Partner: In Partner Prtal, activate the payment prvider Retailer: In Custmer Prtal, test the payment service At the head ffice: Set up payment prcessing and hardware devices Setup payment prcessing Set up devices in the Retail mdule Cnfigure Terminal ID fr specific registers Set up payment methds fr payment prcessing Enable tender types and card types fr specific stres Send payment prcessing changes t the stres Test payment prcessing Stre cmputers: Set up the passwrd plicy Stre cmputers: Set up passwrd-prtected screen savers Stre cmputers: Turn ff System Restre Turn ff System Restre n Windws Turn ff System Restre n Windws Embedded POSReady In Micrsft Dynamics AX, set up Accunts receivable fr Payment Services Implementatin Guide fr PCI Cmpliance Table f cntents i

4 In Micrsft Dynamics AX, set up nline stres fr Payment Services Part 2: Features that facilitate PCI cmpliance Audit lgging User names, passwrds, and authenticatin Set up a new cashier in Micrsft Dynamics AX Data strage and deletin Data transmissins Flw f payment data in Retail POS Flw f payment data in Micrsft Dynamics AX Accunts receivable Flw f payment data in a Micrsft Dynamics AX nline stre Part 3: Cnnectin limitatins Internet cnnectins Wireless cnnectins Remte access Nn-cnsle administrative access Part 4: Audit lgging Mnitr Micrsft Dynamics AX activity View infrmatin abut user lgn and user lgff View the audit trail View the SQL Server trace lg files Mnitr Retail POS activity Mnitr event lgs Part 5: Sftware updates and supprt Sftware updates Trubleshting and supprt Supprt persnnel access the custmer's desktp Supprt persnnel btain a cpy f the stre database Supprt persnnel travel t the custmer's place f business Distributin f htfixes Appendix A: Versin histry Implementatin Guide fr PCI Cmpliance Table f cntents ii

5 Intrductin The requirements in this guide must be fllwed if yu want t implement Micrsft Dynamics AX 2012 and Payment Services fr Micrsft Dynamics ERP (the integrated payment slutin frm Micrsft) in a way that is cmpliant with the Payment Card Industry (PCI) Data Security Standard versin 2.0. Nte Micrsft Dynamics AX 2012 includes Micrsft Dynamics AX fr Retail. The requirements in this guide represent best practices that shuld be implemented even if yu are nt required t cmply with the PCI Data Security Standard. This guide is intended fr and disseminated t custmers, Micrsft Certified Partners, resellers, and integratrs wh are deplying Micrsft Dynamics AX 2012 in a retail rganizatin where electrnic credit card and debit card payments are accepted, and where Micrsft Dynamics AX 2012 is used as the payment applicatin. As a payment applicatin, Micrsft Dynamics AX 2012 is subject t the PCI Payment Applicatin Data Security Standard (PA-DSS). The cntents f this guide reflect that standard. Imprtant Althugh this guide is made available t Micrsft custmers, sme f the steps in the guide are technical and shuld be cmpleted nly by a Micrsft Certified Partner. Implementatin by anyne ther than a Micrsft Certified Partner culd be cnsidered cause fr cncern by PCI Security Standards Cuncil assessrs, and culd cmprmise the security f bth cardhlder and prprietary infrmatin. Micrsft Dynamics AX 2012 has been validated fr PCI cmpliance nly with Payment Services fr Micrsft Dynamics ERP, the integrated payment slutin frm Micrsft. If yu intend t use Micrsft Dynamics AX 2012 with anther payment slutin, yu must btain separate cmpliance validatin. Get the latest release f this guide This guide is reviewed annually, whenever a service pack r htfix fr Micrsft Dynamics AX 2012 is released, and whenever an update t ne f the Data Security Standards is released. Fr infrmatin abut what has changed, see Appendix A: Versin histry, later in this guide. T btain the mst up-t-date cpy f this guide, g t Fr mre infrmatin T read the full text f the PCI Data Security Standard r the PCI Payment Applicatin Data Security Standard, g t Micrsft prvides training materials t ur partners, resellers, and integratrs t help implement Micrsft Dynamics AX Fr mre infrmatin, g t Micrsft Dynamics AX. Implementatin Guide fr PCI Cmpliance Intrductin 1

6 Part 1: Setup Fr PCI cmpliance, yu must cmplete all the prcedures in this part f the guide. Install the sftware T deply Micrsft Dynamics AX 2012 in a manner that is PCI-cmpliant, fllw the instructins in the Micrsft Dynamics AX 2012 Upgrade Guide, which is available as a dwnlad at Imprtant Fr maximum security, Micrsft Dynamics AX 2012 must be installed in the Prgram Files flder r a lcatin with similar access cntrl prtectins. Requirement f the PCI Data Security Standard specifies that grup, shared, and generic accunts (fr example, the sa accunt fr access t the database) must be disabled r remved. All cmputers: Maintain security Yu must install security htfixes and service packs as sn as they becme available. Fr best results, turn n Autmatic Updates. All cmputers: Prepare fr mnitring f event lgs The event lgging capabilities built in t Micrsft Windws help yu cmply with Requirements 10.2 and 10.3 f the PCI Data Security Standard. Cmplete the fllwing prcedure n all cmputers t cnfigure the retentin perid fr event lgs. Imprtant The event lgging shuld nt be disabled and ding s will result in nn-cmpliance with PCI DSS. 1. If yu are running Windws Embedded POSReady 2009, click Start, click Cntrl Panel, switch t Classic View, duble-click Administrative Tls, and then duble-click Event Viewer. If yu are running Windws 7, Windws Embedded POSReady 7, Windws 8, Windws 8.1, Windws Server 2012, r Windws Server 2008, click Start, type Event Viewer in the search bx, and then press ENTER. 2. If the Windws Lgs flder is available, expand it, right-click Security, and then click Prperties. 3. In the Maximum lg size field, type Select Overwrite events as needed, and then click OK. All cmputers: Set up auditing f file access, bject access, and audit plicy changes Implementatin Guide fr PCI Cmpliance Part 1: Setup 2

7 All access t PCs, servers, and databases with Micrsft Dynamics AX must be cntrlled via unique user ID and PCI DSS cmpliant secure authenticatin. T audit changes made t the cmputer's audit plicy, and access t lg files and system bjects, cmplete bth the fllwing prcedures n all cmputers. Nte In an implementatin f Micrsft Dynamics AX 2012 that uses Payment Services fr Micrsft Dynamics ERP, n cardhlder data is stred, and users cannt change the flw r security f cardhlder data. Nevertheless, yu must cmplete the prcedures in this sectin t cmply with Requirements 10.2 and 10.3 f the PCI Data Security Standard, and t help make rganizatinal data mre secure. Fr dmain cmputers, wrk with the dmain administratr t ensure that lcal audit plicies are nt verwritten by less stringent dmain plicies. Fr infrmatin abut viewing and managing lg files, see Part 4: Audit lgging, later in this guide. Enable auditing f file access, bject access, and audit-plicy changes 1. If yu are running Windws Embedded POSReady 2009, click Start, click Cntrl Panel, switch t Classic View, duble-click Administrative Tls, and then duble-click Lcal Security Plicy. If yu are running Windws 7, Windws Embedded POSReady 7, Windws 8, Windws 8.1, Windws Server 2012, r Windws Server 2008, click Start, type Lcal Security Plicy in the search bx, and then press ENTER. 2. Expand the Lcal Plicies flder, and then click Audit Plicy. 3. Duble-click Audit accunt lgn events, select bth the Success and Failure check bxes, and then click OK. 4. Duble-click Audit accunt management, select bth the Success and Failure check bxes, and then click OK. 5. Duble-click Audit bject access, select bth the Success and Failure check bxes, and then click OK. 6. Duble-click Audit plicy change, select bth the Success and Failure check bxes, and then click OK. Audit access t system flders and files The fllwing prcedure prvides steps fr turning n flder and file auditing. The flders that yu must audit vary by perating system. Fr Windws 7, Windws Embedded POSReady 7, Windws 8, Windws 8.1, Windws Server 2012, r Windws Server 2008: C:\Windws\System32\winevt\Lgs. The flder where Micrsft Dynamics AX 2012 is installed (by default, C:\Prgram Files\Micrsft Dynamics AX r, n a 64-bit cmputer, C:\Prgram Files (x86)\micrsft Dynamics AX). See the nte in step 8 f the fllwing prcedure. Implementatin Guide fr PCI Cmpliance Part 1: Setup 3

8 The Micrsft SQL Server data directry (by default, C:\Prgram Files\Micrsft SQL Server\<instance name>\mssql\lg). Fr Windws Embedded POSReady 2009: C:\Windws\System32\cnfig. The flder where Micrsft Dynamics AX 2012 is installed (by default, C:\Prgram Files\Micrsft Dynamics AX). See the nte in step 8 f the fllwing prcedure. The SQL Server data directry (by default, C:\Prgram Files\Micrsft SQL Server\<instance>\MSSQL\Lg). Cmplete this prcedure fr each flder in the previus lists. 1. In Windws Explrer, right-click the flder name, and then click Prperties. 2. On the Security tab, click Advanced. Nte If the Security tab is nt available, click Flder Optins n the Tls menu, click the View tab, and then clear the Use simple file sharing check bx. 3. Click the Auditing tab. If yu receive a security message, click Cntinue. 4. Click Add. 5. In the Enter the bject name t select field, type Everyne, and then click Check Names. 6. If the name is valid, click OK. 7. In the Apply nt field, make sure that This flder, subflders and files is selected. 8. In the Access list, select bth the Successful and Failed check bxes fr the fllwing privileges, and then click OK: Create files/write data Create flders/append data Delete subflders and files Delete Read permissins Change permissins Nte D nt enable Read permissins fr the flder where Micrsft Dynamics AX fr Retail POS is installed (by default, C:\Prgram Files\Micrsft Dynamics AX\60\Retail POS). 9. If the previus settings prvide mre auditing than is therwise set up fr the flder, select the Replace all existing inheritable auditing entries check bx, and then click OK. 10. Click OK in the remaining dialg bxes. Required services and prtcls The fllwing table lists the services and prtcls that are required by Micrsft Dynamics AX fr Retail and its cmpnents. Implementatin Guide fr PCI Cmpliance Part 1: Setup 4

9 Retail cmpnents Retail Headquarters Required services and prtcls Micrsft Dynamics AX Cmmerce Data Exchange: Async Server Internet Infrmatin Services SQL Server (Default prt: 1433) Cmmerce Data Exchange: Synch Service Windws Sckets Internet Prtcl security (IPsec) (Default prt: 16750) SQL Server (Default prt: 1433) Micrsft Dynamics AX.NET Business Cnnectr (BC.NET) Cmmerce Data Exchange: Real-time Service Internet Infrmatin Services Business Cnnectr (BC.NET) Cmmerce Data Exchange: Real-time Service Micrsft.NET Remting (Default prt: 1239) Retail POS Internet Infrmatin Services.NET Business Cnnectr (BC.NET) SQL Server (Default prt: 1433) Retail POS Offline Sync Service Micrsft Sync Framewrk 2.1 Retail POS Database Utility SQL Server (Default prt: 1433) Cmmunicatin and database cmputers: Open the firewall T establish cmmunicatins between cmputers in the rganizatin, pen the firewall n any cmmunicatins server and n stre database cmputers, as described in the fllwing table. Type f cmputer Open the firewall t these prgrams Head ffice cmmunicatins server Cmmerce Data Exchange: Synch Service Cmmerce Data Exchange: Real-time Service Stre cmmunicatins server SQL Server, t enable cnnectins t the message database Stre database server Stre register with its wn lcal database Cmmerce Data Exchange: Synch Service SQL Server SQL Server, but nly if Cmmerce Data Exchange: Synch Service is n a different cmputer Implementatin Guide fr PCI Cmpliance Part 1: Setup 5

10 Nte Instead f pening the firewall t Cmmerce Data Exchange: Synch Service and Cmmerce Data Exchange: Real-time Service, yu might prefer t pen the firewall t the TCP prts used by these prgrams. In this case, yu must knw the prt numbers that yu specified when yu deplyed the services. By default, the prt numbers are 1433 fr SQL Server, fr Cmmerce Data Exchange: Synch Service, and 1239 fr Cmmerce Data Exchange: Real-time Service. If yu are using multiple instances f Cmmerce Data Exchange: Synch Service n a single cmputer, we recmmend that yu pen the firewall t specific prt numbers instead. Depending n the settings f yur firewall, yu might als need t pen the firewall t utbund traffic n client and register cmputers. T determine whether this is necessary, cnsult yur netwrk administratr. The instructins in the rest f this sectin are fr Windws Firewall. If yu are using anther firewall, see the firewall dcumentatin fr mre infrmatin. Open Windws Firewall n Windws 7, Windws 8, Windws 8.1, Windws Server 2008, r Windws Server 2012 T pen Windws Firewall t a prgram n Windws 7, Windws 8, Windws 8.1, Windws Server 2008, r Windws Server 2012, use the New Rule Wizard t create a rule that manages the cnnectins that the allwed prgram can receive. Yu can use the default settings fr each rule, but yu must prvide the path f the prgram and a name fr the rule. Prgram Typical prgram path Suggested rule name SQL Server Cmmerce Data Exchange: Async Server (if installed) Cmmerce Data Exchange: Real-time Service (if installed) C:\Prgram Files\Micrsft SQL Server\<instance name>\mssql\binn\sqlservr.exe C:\Prgram Files (x86)\micrsft Dynamics AX\60\CDX\Async Server C:\Prgram Files (x86)\micrsft Dynamics AX\60\CDX\Real-time Services SQL Server <instance name> Cmmerce Data Exchange Async Server Cmmerce Data Exchange Real-time Service Nte On a 64-bit perating system, Cmmerce Data Exchange: Async Server and Cmmerce Data Exchange: Real-time Service are in the Prgram Files (x86) flder path instead. 1. Lg n t the cmputer as a Windws Administratr. 2. Click Start, type wf.msc in the search bx, and then press ENTER. 3. Click Inbund Rules. 4. T create a new rule, click New Rule, select Prgram, and then cmplete the New Inbund Rule Wizard. 5. Repeat step 4 fr the ther prgrams that shuld be allwed thrugh the firewall. Implementatin Guide fr PCI Cmpliance Part 1: Setup 6

11 Open Windws Firewall n Windws Embedded POSReady Lg n t the cmputer as a Windws Administratr. 2. Click Start, and then click Cntrl Panel. 3. If necessary, switch t Classic View, and then duble-click Windws Firewall. 4. On the Exceptins tab, click Add Prgram. 5. In the Prgrams list, select the prgram, and then click OK. 6. Repeat steps 4 and 5 ther the ther prgrams that shuld be allwed thrugh the firewall, and then click OK. At the head ffice: Set up the passwrd plicy Requirement f the PCI Data Security Standard specifies that grup, shared, and generic accunts must nt be used, and prvides test prcedures fr verifying this. Requirements thrugh specify passwrd and accunt security regulatins fr peple with administrative access t the payment applicatin. T cmply with these requirements, cntact the dmain administratr t establish grup plicies fr the dmain that meet the minimum requirements described in the fllwing table. Plicy Enfrce passwrd histry Maximum passwrd age Minimum passwrd length Passwrd must meet cmplexity requirements Accunt lckut duratin Accunt lckut threshld Security setting 4 passwrds remembered 90 days 7 characters Enabled 30 minutes 6 invalid lgn attempts Nte Users f Micrsft Dynamics AX 2012 are subject t Active Directry Dmain Services security plicies. Therefre, users f Micrsft Dynamics AX are subject t the same passwrd plicy as dmain users. Installing Micrsft Dynamics AX 2012 n a cmputer that is nt part f the dmain is nt supprted. These plicies represent the minimum requirements f Requirements thrugh Mre stringent settings can be used. Fr mre infrmatin abut managing passwrd plicy via grup plicies, see "Wrking with Grup Plicy bjects" at At the head ffice: Set up database lgging By mdifying the audit trail in Micrsft Dynamics AX 2012, yu can enable lgging f the fllwing events in the head ffice database: Implementatin Guide fr PCI Cmpliance Part 1: Setup 7

12 Changes t the audit trail settings. These settings are stred in the DATABASELOG table fr the head ffice and in the RetailFunctinalityPrfile table fr Retail POS. Changes t the payment prcessing cnfiguratin. These settings are stred in the RetailHardwarePrfile table fr bth the head ffice and Retail POS. The creatin, deletin, r mdificatin f cashier user accunts and permissins. These settings are stred in the RetailStaffPermissinGrup table fr the head ffice and in the RetailStaffTable table fr Retail POS. Nte Althugh the lgging f activity in the head-ffice database is related t Requirements 10.2 and 10.3 f the PCI Data Security Standard, it is beynd the scpe f the PCI requirements because, in an implementatin f Micrsft Dynamics AX 2012 that uses Payment Services fr Micrsft Dynamics ERP, n cardhlder data is stred, and users cannt change the cardhlder data flw r the security f cardhlder data. Therefre, the fllwing prcedure is included in this guide as an ptinal best practice that helps make rganizatinal data mre secure. 1. T set up lgging in the head ffice database, click System administratin > Setup > Database > Database lg setup. 2. Create the fllwing new entries by fllwing the wizard. Table name POS functinality prfile POS hardware prfiles Cmpnent Item ID Staff permissin grup Staff Audit trail setup Actual system name RetailFunctinalityPrfile RetailHardwarePrfile RetailStaffLginLg RetailStaffPermissinGrup RetailStaffTable SysDatabaseLgTableSetup 3. Click System administratin > Setup > Licensing > Licensing cnfiguratin. 4. Under Administratin, select the Electrnic signature check bx, and then click OK. If yu are prmpted t synchrnize tables, click Yes. Nte This prcedure sets up lgging n Insert, Delete, Update, and RenameKey actins. T view r mdify this setup, click System administratin > Setup > Database > Database lg setup. Fr each change t ne f these tables, Micrsft Dynamics AX recrds the user wh perfrmed the actin, the table that was mdified, the actin that was taken, the attribute that was changed, the time and date f the actin, and the ID f the recrd that was mdified r added. Fr each Update actin, it als recrds bth the previus and new settings. By default, any user wh has database access can query a database lg by using.net Business Cnnectr, X++, r alerts, r by using direct database access. T prtect data, restrict permissins n the SysDatabaseLg table. Fr mre infrmatin, see "Manage Implementatin Guide fr PCI Cmpliance Part 1: Setup 8

13 table and field access" at and "Table Prperties" at Fr infrmatin abut viewing lgged actins, see Mnitr Micrsft Dynamics AX activity, later in this guide. At the head ffice: Enable SQL Server trace lgging T mnitr access t the audit lg, enable SQL Server trace lgging by using the AxRetailTrace.sql file. Nte AxRetailTrace.sql is included in the Micrsft Dynamics AX 2012 dwnlad package and can be fund in the RetailSecurityGrups subflder f the flder where yu extracted the installatin files. Althugh this prcedure is related t Requirements 10.2 and 10.3 f the PCI Data Security Standard, it is beynd the scpe f the PCI requirements because, in an implementatin f Micrsft Dynamics AX 2012 that uses Payment Services fr Micrsft Dynamics ERP, n cardhlder data is stred, and users cannt change the cardhlder data flw r the security f cardhlder data. Therefre, the fllwing prcedure is included in this guide as an ptinal best practice that helps make rganizatinal data mre secure. 1. Cpy AxRetailTrace.sql t the cmputer where the head ffice database is lcated. 2. Open SQL Server Management Studi, and cnnect t the instance f SQL Server that is used in the Micrsft Dynamics AX deplyment. 3. On the File menu, pint t Open, click File, brwse t and select the.sql file, and then click OK. 4. Click Execute. Nte The trace lg files are lcated in the Lg directry fr the instance. SQL Server trace lg files have a maximum size f 100 MB. When the size f a lg file exceeds this limit, a new lg file is created by using a date-based numbering scheme. Fr infrmatin abut viewing and managing lg files, see Part 4: Audit lgging, later in this guide. A cmmented sectin at the end f the AxRetailTrace.sql script file cntains the cde fr perfrming several peratins related t trace lgging. These include manually starting and stpping the trace, viewing the cntents f the Micrsft Dynamics AX lg tables, viewing the trace detail, and disabling the autmatic start f tracing. T cmplete ne f these peratins, cpy the cde fr the peratin int a new query file, mdify the script as described in the cmments, and then click Execute. Obtain a Payment Services fr Micrsft Dynamics ERP subscriptin Yu can cnfigure Micrsft Dynamics AX with Payment Services fr Micrsft Dynamics ERP t prcess credit card and debit card transactins at retail pint-f-sale (POS) registers, in nline stres, and in the Accunts receivable mdule in Micrsft Dynamics AX. Payment Services accepts a variety f payment types, and yu can chse frm several payment prviders. Implementatin Guide fr PCI Cmpliance Part 1: Setup 9

14 The prcess fr setting up Payment Services includes the fllwing steps, sme perfrmed by the retailer and thers by the Micrsft Dynamics AX partner. The steps are perfrmed in this rder: 1. Partner: In Partner Prtal, create a Payment Services accunt fr the retailer. 2. Retailer: In Custmer Prtal, set up a merchant accunt with a payment prvider. 3. Partner: In Partner Prtal, activate the payment prvider. 4. Retailer: In Custmer Prtal, test the payment service. Nte When wrking with payments accunts fr custmers, partners must use the custmer's Micrsft accunt, rather their wn Micrsft accunt. Partner: In Partner Prtal, create a Payment Services accunt fr the retailer 1. Sign in t Partner Prtal by using yur Micrsft accunt address and passwrd. 2. Click Custmer List, and then click New Custmer t add the retailer. 3. Select the retailer in the list, click Add Service, and then create a Payment Services accunt fr the retailer. 4. In the Add Service frm, in the Purpse f accunt field, select Prductin. 5. Click Service List, select the payment service that yu created in step 3, and then click Send Activatin t send an invitatin t the retailer. The retailer receives this invitatin by . Retailer: In Custmer Prtal, set up a merchant accunt with a payment prvider 1. In the invitatin message frm yur Micrsft Dynamics AX partner, click the invitatin link t Payment Services, and then sign in with yur Micrsft accunt address and passwrd. 2. Under Payment settings, click Payment prviders. 3. Cmpare the payment prviders, read their terms, and then click Sign up nw fr the prvider that yu want. If yu select First Data (EMPS), yur cntact infrmatin is autmatically sent t First Data Merchant Services (FDMS). FDMS will cntact yu t prcess the applicatin. If yu select CyberSurce, yur cntact infrmatin is autmatically sent t CyberSurce. CyberSurce will cntact yu t prcess the applicatin. If yu select anther prvider, fllw the prvider s instructins t submit an applicatin. 4. Sign in t Custmer Prtal by using yur Micrsft accunt address and passwrd. 5. Click Service list, select the check bx fr the payment service, and then click Change Partner. 6. In the Change supprt partner frm, select the partner in the list, select the Grant service access t the selected partner check bx, and then click Change Partner. Implementatin Guide fr PCI Cmpliance Part 1: Setup 10

15 Nte If yu d nt find yur partner in the list, tell yur partner t register as a partner fr nline services fr Micrsft Dynamics ERP. Fr mre infrmatin, see the Partner Prtal Prvisining Guide. 7. Sign ut f Custmer Prtal. The payment prvider will cntact yu t prcess yur applicatin and set up a merchant accunt fr yu. The prcess f setting up a merchant accunt typically includes perfrming a credit check, discussing terms f service, and signing a cntract with the payment prvider. This might take several days. This prcess des nt invlve any actin in Micrsft Dynamics AX. After yur merchant accunt is set up with the payment prvider, the payment prvider prvides the settings fr the merchant accunt t yu. Prvide the settings fr the merchant accunt t yur Micrsft Dynamics AX partner. Partner: In Partner Prtal, activate the payment prvider 1. Sign in t Partner Prtal by using yur Micrsft accunt address and passwrd. 2. In the Custmer list, select the custmer, and then click the link in the Services clumn. 3. Select the service, and then click Open Service. 4. Under Payment Settings, click Payment Methds. 5. Under Payment Prvider Accunts, select an accunt, and then under Actins, click Activate. The Payment Services website displays the Payment Prvider Accunt Activatin frm. 6. Depending n the payment prvider, d ne f the fllwing: First Data Use the fllwing guidelines t enter the merchant accunt infrmatin that yu received frm the retailer and the payment prvider, and then click Activate. AcquirerBin Enter the acquirer BIN (Bank Identificatin Number). AgentBankNumber Enter the agent number. AgentChainNumber Enter the chain number. City Enter the city f the merchant. Cuntry / Regin Cde Enter the three-letter cuntry cde, such as USA r CAN. Enter the address that was prvided t the payment prvider. LanguageCde Enter the tw-letter language cde, such as 00 fr US English. LcatinNumber Enter the lcatin number. MerchantAbaNumber If a value is nt prvided by the payment prvider, leave this field blank. MerchantCategryCde Enter the merchant categry, als knwn as the SIC (Standard Industry Cde). This is prvided by the payment prvider. MerchantId Enter the merchant number. MerchantName Enter the name f the merchant. Pstal Cde Enter the pstal cde f the merchant. Implementatin Guide fr PCI Cmpliance Part 1: Setup 11

16 Reimbursement If a value is nt prvided by the payment prvider, leave the field blank. ServicePhneNumber Enter SettlementAgentNumber If a value is nt prvided by the payment prvider, leave the field blank. SharingGrup If a value is nt prvided by the payment prvider, leave the field blank. MerchantState Enter the state r prvince f the merchant, such as WA fr Washingtn. StreNumber Enter the stre number. Street Address Enter the street address f the merchant. TerminalId Enter the terminal number f the merchant. VNumber Enter the V number. The V number is seven digits and starts with 7. First Data/Express Merchant Prcessing Slutins (EMPS) Use the fllwing guidelines t enter the merchant accunt infrmatin that yu received frm the retailer and the payment prvider, and then click Activate. DOPSIdentifier Enter DOPSIdentifier. DOPSPasswrd Enter DOPSPasswrd. MerchantCategryCde Enter the merchant categry cde, which is als called the MCC cde. This is prvided by the payment prvider. MerchantCity Enter the city f the merchant. MerchantCuntryCde Enter the tw-letter cuntry cde, such as US r CA. MerchantId Enter the merchant ID. If there are tw merchant IDs, d nt enter Nashville MID. MerchantName Enter the name f the merchant. MerchantPstalCde Enter the pstal cde f the merchant. MerchantStateOrPrvince Enter the state r prvince f the merchant. MerchantStatus Enter 1. MerchantStreetAddress Enter the street address f the merchant. ServicePhneNumber Enter StreNumber If a value is nt prvided by the payment prvider, leave this field blank. TerminalId Enter the terminal ID f the merchant. CyberSurce Use the fllwing guidelines t enter the merchant accunt infrmatin that yu received frm the retailer and the payment prvider, and then click Activate. MerchantId If a value is nt prvided by the payment prvider, enter MerchantId. RawPrvisinData Enter any value, such as 123abc. Nte Yu must have tw CyberSurce accunts; ne fr transactins in which the card is present and ne fr transactins in which the card is nt present. Bth accunts need t be activated in the CyberSurce live envirnment. Implementatin Guide fr PCI Cmpliance Part 1: Setup 12

17 PayPal N actin is needed. A merchant accunt is activated autmatically after it is created and activated by the payment prvider. 7. Under Accepted Payment Methds, select the payment prvider t use fr each payment methd. 8. Click Save and Clse. Retailer: In Custmer Prtal, test the payment service 1. Sign in t Custmer Prtal by using yur Micrsft accunt address and passwrd. 2. Click Dashbard, and then click the Payment Services accunt. 3. Under Places, click Manage payments, and then click New Payment. 4. Under Card Infrmatin, enter the required infrmatin, including a minimum payment amunt, such as $ Under Billing Address, enter the required infrmatin, and then click Prcess Payment. 6. Repeat steps 3 thrugh 5 fr each type f credit card that yu accept in yur stres. 7. Sign ut f Custmer Prtal. 8. Cntact the payment prvider fr each test transactin and make sure that the transactins are prcessed crrectly. Als check that the crrect transactins fees are assessed, as specified in yur payment prvider agreement. 9. Sign in t Custmer Prtal, click Dashbard, and then click the same Payment Services accunt as in step Under Places, click Manage payments, and then select and refund each f the test transactins. At the head ffice: Set up payment prcessing and hardware devices fr stres In Micrsft Dynamics AX 2012, the nly time that stre emplyees have access t card numbers is at the time f sale, when the cashier swipes the card. Payment infrmatin is sent directly frm Retail POS t the prcessr at that time, and transactins are settled immediately. Payment infrmatin in the Micrsft Dynamics AX 2012 database is limited t the custmer's name, the payment amunt, the card type, and the last fur digits f the card number. The entire primary accunt number (PAN) is never stred. Setup payment prcessing After auditing and ther security measures are in place, the stre can begin accepting card payments. T d this, cmplete the fllwing steps: 1. Obtain a Payment Services fr Micrsft Dynamics ERP subscriptin, and assciate it with the retail rganizatin's merchant accunt. Fr mre infrmatin abut Payment Services fr Micrsft Dynamics ERP, g t 2. Click Retail > Setup > POS > Prfiles > Hardware prfiles, and then in the left pane, select the hardware prfile fr the stre. Implementatin Guide fr PCI Cmpliance Part 1: Setup 13

18 3. On the EFT service FastTab, in the EFT service field, select Payment Cnnectr. 4. In the Merchant accunt ID field, enter the merchant accunt ID that yu received frm the payment prvider. 5. In the Service accunt ID field, enter the service accunt ID that yu received frm the payment prvider. 6. In the Micrsft accunt field, enter the Micrsft accunt address. This must be the same Micrsft accunt that was used t set up the merchant accunt n Custmer Prtal. 7. In the Micrsft accunt passwrd field, enter the passwrd fr the Micrsft accunt. 8. In the Supprted currencies field, enter currency cdes fr the currencies that are supprted by the payment service. Separate the currency cdes by semiclns withut spaces. Fr example, enter USD;CAD. 9. In the Supprted payment methds field, enter the payment methds that are accepted by the payment service. Separate the payment methds by semiclns withut spaces. Fr example, enter Visa;AmericanExpress;Debit. 10. Cpy the cntents f the Public key field. 11. Sign in t Custmer Prtal by using yur Micrsft accunt address and passwrd. 12. Under Organizatin settings, click User management, and then in the New grup, click System User. 13. In the Public key field, enter the public key that yu cpied in step 10, and then click Save. 14. In the User management list, click the first name r the last name f the system user that yu created in step 13, and then click Edit. 15. Under Services and Rles, select Payment Administratrs in the Available Rles list, use the right arrw buttn t add the rle t the Selected Rles list, and then click Save. 16. Sign ut f Custmer Prtal. 17. Assciate a hardware prfile with each register t enable payment prcessing and t select devices. Fr mre infrmatin, see Set up devices in the Retail mdule. 18. Set up payment methds t use payment prcessing. Fr mre infrmatin, see Set up payment methds fr payment prcessing. 19. Enable ne r mre payment prcessing tender types fr each stre. Fr mre infrmatin, see Enable tender types and card types fr specific stres. 20. Turn n payment prcessing at stres by running scheduled jbs. Fr mre infrmatin, see Send payment prcessing changes t the stres. 21. Cnfigure Accunts receivable fr payment prcessing t supprt custmer rders. Fr mre infrmatin, see In Micrsft Dynamics AX, set up Accunts receivable fr Payment Services. Nte These steps are nt specifically required fr PCI cmpliance. Hwever, if these steps are skipped, the stre cannt use Micrsft Dynamics AX 2012 t prcess the payments that are subject t the PCI Data Security Standard. The steps are described in mre detail later in this sectin. By using Payment Services fr Micrsft Dynamics ERP, yu can easily and securely accept and prcess credit and debit card payments in yur applicatins, nline, frm the Implementatin Guide fr PCI Cmpliance Part 1: Setup 14

19 head ffice, and in yur stres. The PCI-certified service lets yu chse frm a number f payment prviders, and seamlessly incrprates multiple payment ptins withut the need fr additinal sftware r integratin. As Micrsft Dynamics AX 2012 is shipped in the United States and Canada, the nly prcessr that it cmmunicates with is Payment Services fr Micrsft Dynamics ERP. This cmmunicatin is cnfigured in the Retail mdule, and then the settings are sent dwn t the stres. During authrizatin and settlement, these settings are used t identify the rganizatin's subscriptin and its assciated merchant accunt. N cardhlder data is included. Imprtant Micrsft Dynamics AX 2012 has been validated fr PCI cmpliance nly with Payment Services fr Micrsft Dynamics ERP. If yu intend t use Micrsft Dynamics AX 2012 with anther payment slutin, yu must btain separate cmpliance validatin. Set up devices in the Retail mdule Yu must btain the actual device names frm the stre t cmplete this prcedure. Device names can be viewed n the register by viewing the apprpriate device class (MSR, PINPad, r POSPrinter) in the fllwing registry key: HKEY_LOCAL_MACHINE\SOFTWARE\OLEfrRetail\ServiceOPOS 1. Click Retail > Setup > POS > Prfiles > Hardware prfiles. 2. In the list, select the crrect prfile. 3. Cnfigure hardware devices, such as receipt printers, MSRs (magnetic stripe readers), and PIN (persnal identificatin number) pad devices. On the tab fr each device, in the Device name field, type the apprpriate device name. A descriptin fr the device is ptinal. Nte Yu must use the same device names in the hardware prfile that yu use when yu cnfigure the actual devices n each terminal. If yu have registers where payment prcessing will nt take place, cnsider using a hardware prfile that des nt have payment prcessing cnfigured. Yu must create a separate hardware prfile fr each cmbinatin f devices used at the stres. Similarly, if like devices are named differently n different registers r at different stres, yu must create additinal hardware prfiles. Cnfigure Terminal ID fr specific registers T enable payment prcessing and select devices, assciate the hardware prfile with each register. 1. Click Retail > Setup > POS > POS Registers. 2. Duble-click the register t mdify. 3. On the General tab, in the Hardware prfile field, select the apprpriate prfile. Then, in the EFT POS register number field, type ne f the terminal IDs that yu received frm the payment prvider. Implementatin Guide fr PCI Cmpliance Part 1: Setup 15

20 Nte Sme payment prviders refer t EFT POS register numbers as terminal IDs. In Retail POS, terminal ID refers t the terminal number shwn n the General tab. The terminal number and the EFT POS register number d nt have t match, but bth numbers must be unique fr each terminal. 4. Repeat steps 2 and 3 fr ther registers. When yu have finished assciating hardware prfiles with registers, clse the frm. Set up payment methds fr payment prcessing Payment methds are the types f tender accepted by the stre in this case, credit cards and debit cards. Card types are the specific credit cards accepted fr a card tender type. Fr mre infrmatin abut the steps in this prcedure, see Micrsft Dynamics AX 2012 Help. 1. Click Retail > Setup > Payment methds > Payment methds. 2. On the tlbar, click New. 3. In the new rw, type a unique number and descriptin fr the new payment methd. Then, in the Default functin clumn, click the arrw, and select Card. 4. Clse the frm. 5. Click Retail > Setup > Payment methds > Card types. 6. On the tlbar, click New. 7. In the new rw, type a unique ID and name fr the new card type. Then, in the Card types clumn, click the arrw, and select the apprpriate ptin. 8. While the new rw is still selected, click Card number. 9. Create a verificatin mask fr the card type by entering the range f digits that all cards f this type begin with. Fr example, Visa card numbers begin with 4, s yu culd verify that cards accepted as the Visa card type are really Visa cards by creating a mask f Clse the Card number frm. 11. Clse the Card type frm. Enable tender types and card types fr specific stres 1. Click Retail > Cmmn > Retail channels > Retail stres. 2. Select a stre, and then, n the Setup tab, click Payment methds. 3. On the tlbar, click New, and then, n the General tab, in the Payment methd field, select a payment methd. The infrmatin fr the selected payment methd is filled in autmatically. 4. While the new payment methd rw is still selected, click Card setup. 5. On the tlbar, click New, and then, in the Card ID field, select the card type fr this payment methd. 6. Select the new card setup, and then, n the General tab, select the Check expiratin date check bx. Implementatin Guide fr PCI Cmpliance Part 1: Setup 16

21 7. Clse the Card setup frm. 8. Clse the Payment methd frm. 9. Repeat steps 3 thrugh 8 fr any ther payment methds fr this stre. Send payment prcessing changes t the stres Payment prcessing changes d nt take effect until the assciated scheduled jbs are run and the infrmatin included in the jbs is sent dwn t the stres. This prcedure describes hw t run the jbs manually. 1. Click Retail > Peridic > Data distributin > Create actins. The preactins that were generated when yu changed the payment prcessing settings are cnverted int actins, r jbs. 2. Click Retail > Peridic > Data distributin > Distributin schedule. 3. T send dwn the payment prcessing and device settings in the hardware prfile, select the 1090 Registers jb, and then click Run directly. 4. T send dwn the payment methds, card types, and card numbers, select the 1070 Stres and tenders jb, and then click Run scheduler jb directly. Test payment prcessing Yu can test payment prcessing by prcessing card transactins in test mde. 1. In a register r stre database, in the POSHARDWAREPROFILE table, change the value in the EFTTESTMODE clumn t Prcess a card transactin. 3. Verify that the transactin went thrugh by visiting the Payment Services payment prtal at Nte Yu can test payment prcessing nly if Retail POS is running in prductin mde. Stre cmputers: Set up the passwrd plicy Requirements thrugh f the PCI Data Security Standard specify passwrd and accunt security regulatins fr peple with access t the payment applicatin. T cmply with these requirements, the passwrd plicy n each stre cmputer where Retail POS is installed must meet the minimum requirements described in the fllwing table. Plicy Enfrce passwrd histry Maximum passwrd age Minimum passwrd length Passwrd must meet cmplexity requirements Accunt lckut duratin Accunt lckut threshld Security setting 4 passwrds remembered 90 days 7 characters Enabled 30 minutes 6 invalid lgn attempts Implementatin Guide fr PCI Cmpliance Part 1: Setup 17

22 Nte These plicies represent the minimum requirements f Requirements thrugh Mre stringent settings can be used. Fr mre infrmatin abut setting up a Windws accunt fr each stre user, see the Micrsft Dynamics AX 2012 Upgrade Guide, which is available as a dwnlad at 1. If yu are running Windws Embedded POSReady 2009, click Start, click Cntrl Panel, switch t Classic View, duble-click Administrative Tls, and then duble-click Lcal Security Plicy. If yu are running Windws 7, Windws Embedded POSReady 7, Windws 8, Windws 8.1, Windws Server 2008, r Windws Server 2012, click Start, type Lcal Security Plicy in the search bx, and then press ENTER. 2. Expand Accunt Plicies, and then click Passwrd Plicy. 3. T mdify a plicy, right-click the plicy, and then click Prperties. 4. Click Accunt Lckut Plicy. 5. T mdify a plicy, right-click the plicy, and then click Prperties. Stre cmputers: Set up passwrd-prtected screen savers At each register, set up a screen saver that appears when the register is idle, and that requires the passwrd fr the cashier's Windws user accunt t be entered befre access t Retail POS is regained. 1. In the C:\Windws\System32 flder, lcate the screen saver (.scr) file t use. 2. If yu are running Windws Embedded POSReady 2009, click Start, click Run, type mmc, and then click OK. If yu are running Windws 7, Windws Embedded POSReady 7, Windws 8, Windws 8.1, Windws Server 2008, r Windws Server 2012, click Start, type mmc in the search bx, and then press ENTER. 3. On the File menu, click Add/Remve Snap-in, and then, if yu are running Windws Embedded POSReady 2009, click Add. 4. Select Grup Plicy Object Editr, click Add, click Finish, and then click Clse r OK. 5. Expand Lcal Cmputer Plicy, expand User Cnfiguratin, expand Administrative Templates, expand Cntrl Panel, and then click Persnalizatin (n Windws 7) r Display (n ther perating systems). 6. Duble-click Frce specific screen saver (n Windws 7) r Screen Saver executable name (n ther perating systems), select Enabled, type the path and name f the screen saver (.scr) file that yu selected in step 1, and then click OK. 7. Duble-click Passwrd prtect the screen saver, select Enabled, and then click OK. 8. Duble-click Screen Saver timeut, select Enabled, type 900 r a smaller value, and then click OK. Implementatin Guide fr PCI Cmpliance Part 1: Setup 18

23 Nte Cmpleting this prcedure n each cmputer in the stre helps satisfy Requirement f the PCI Data Security Standard. Accrding t this requirement, 900 secnds (15 minutes) is the maximum time that the register can be idle withut lcking. Yu can specify a shrter time if yu prefer. Stre cmputers: Turn ff System Restre System Restre is a Windws feature that restres yur cmputer's system files t the state they were in at an earlier time. The restre pints saved by this feature are nt cnsidered secure by the PCI Security Standards Cuncil. Nte System Restre is nt available n Windws Server Turn ff System Restre n Windws 7 1. On the Start menu, right-click Cmputer, and then click Prperties. 2. Click System prtectin. 3. Select the C: drive, click Cnfigure, select Turn ff system prtectin, and then click OK. Turn ff System Restre n Windws Embedded POSReady On the Start menu, right-click My Cmputer, and then click Prperties. 2. On the System Restre tab, select the Turn ff System Restre check bx, and then click OK. In Micrsft Dynamics AX, set up Accunts receivable fr Payment Services 1. Click Accunts receivable > Setup > Payment > Payment services. 2. In the Payment services frm, click New, and then in the Payment service field, enter a name fr the payment service. 3. In the Payment cnnectr field, select Dynamics Payment Cnnectr. 4. Under Payment service accunt, enter the fllwing infrmatin: In the Merchant accunt ID field, enter the merchant accunt ID that yu received frm the payment prvider. In the Service accunt ID field, enter the service accunt ID that yu received frm the payment prvider. In the Micrsft accunt field, enter the Micrsft accunt address. This must be the same Micrsft accunt that was used t set up the merchant accunt n Custmer Prtal. In the Micrsft accunt passwrd field, enter the passwrd fr the Micrsft accunt. In the Supprted currencies field, enter currency cdes fr the currencies that are supprted by the payment service. Separate the currency cdes by semiclns, withut using spaces. Fr example, enter USD;CAD. Implementatin Guide fr PCI Cmpliance Part 1: Setup 19

24 In the Supprted payment methds field, enter the payment methds that are accepted by the payment service. Separate the payment methds by semiclns withut spaces. Fr example, enter Visa;AmericanExpress;Debit. Nte Infrmatin is entered autmatically in the Assembly name, Envirnment, Prtal URL, and Public key fields. The public key is autmatically generated by Micrsft Dynamics AX t encrypt the data that is sent t the payment service. 5. Cpy the cntents f the Public key field. 6. Sign in t Custmer Prtal by using yur Micrsft accunt address and passwrd. 7. Under Organizatin settings, click User management, and then in the New grup, click System User. 8. In the Public key field, enter the public key that yu cpied in step 5, and then click Save. 9. In the User management list, click the first name r the last name f the system user that yu created in step 8, and then click Edit. 10. Under Services and Rles, select Payment Administratrs in the Available Rles list, use the right arrw buttn t add the rle t the Selected Rles list, and then click Save. 11. Sign ut f Custmer Prtal. 12. In Micrsft Dynamics AX, in the Payment services frm, click Validate. Micrsft Dynamics AX cnfirms that the validatin is successful. 13. Click Credit card types, and then add all the credit cards that yu accept. In Micrsft Dynamics AX, set up nline stres fr Payment Services 1. Click Retail > Retail channels > Online stres. 2. Select an nline stre, and then n the Actin Pane, click Edit. 3. On the Payment accunts FastTab, in the Cnnectrs field, select Dynamics Payment Cnnectr. 4. Click Add, and then under Details, enter the fllwing infrmatin: In the Merchant accunt ID field, enter the merchant accunt ID that yu received frm the payment prvider. In the Service accunt ID field, enter the service accunt ID that yu received frm the payment prvider. In the Micrsft accunt field, enter the Micrsft accunt address. This must be the same Micrsft accunt that was used t set up the merchant accunt n Custmer Prtal. In the Micrsft accunt passwrd field, enter the passwrd fr the Micrsft accunt. In the Supprted currencies field, enter currency cdes fr the currencies that are supprted by the payment service. Separate the currency cdes by semiclns. Fr example, enter USD;CAD. In the Supprted payment methds field, enter the payment methds that are accepted by the payment service. Separate the payment methds by semiclns Implementatin Guide fr PCI Cmpliance Part 1: Setup 20

25 Nte Infrmatin is entered autmatically in the Assembly name, Envirnment, Prtal URL, and Public key fields. The public key is autmatically generated by Micrsft Dynamics AX t encrypt the data that is sent t the payment service. 5. Cpy the cntents f the Public key field. 6. Sign in t Custmer Prtal with yur Micrsft accunt address and passwrd. 7. Under Organizatin settings, click User management, and then in the New grup, click System User. 8. In the Public key field, enter the public key that yu cpied in step 5, and then click Save. 9. In the User management list, click the first name r the last name f the system user that yu created in step 8, and then click Edit. 10. Under Services and Rles, select Payment Administratrs in the Available Rles list, use the right arrw buttn t add the rle t the Selected Rles list, and then click Save. 11. Sign ut f Custmer Prtal. Implementatin Guide fr PCI Cmpliance Part 1: Setup 21

26 Part 2: Features that facilitate PCI cmpliance This part f the guide discusses sme f the features in Micrsft Dynamics AX 2012 that facilitate merchant cmpliance with the PCI Data Security Standard. Audit lgging Lgging f PCI-relevant activity at the register is autmatic. Fr mre infrmatin, see Mnitr Retail POS activity, later in this guide. User names, passwrds, and authenticatin Stres and cashiers have n administrative access, and n access t reprts. They have access t card numbers nly when a card is swiped. Users f Micrsft Dynamics AX are subject t Active Directry Dmain Services security plicies. Therefre, users f Micrsft Dynamics AX are subject t the same passwrd plicy as dmain users. Emplyee user names and passwrds are set up in the Retail mdule f Micrsft Dynamics AX Only apprved Micrsft Dynamics AX users have access t these features. Micrsft Dynamics AX 2012 des nt prvide any default accunts r passwrds. Instead, a unique user name and passwrd are required fr each user, including the user wh sets up the sftware. These features help satisfy Requirements 2.1 and 8 f the PCI Data Security Standard. Activities related t setting up new emplyees, deleting emplyees, and changing emplyee user names r passwrds are lgged. Fr mre infrmatin, see Mnitr Micrsft Dynamics AX activity, later in this guide. When cashiers lg n t Retail POS at the stre, their emplyee user names and passwrds are securely authenticated by either Cmmerce Data Exchange: Real-time Service r Cmmerce Data Exchange: Synch Service, depending n emplyee settings. Cashier passwrds are always hashed (bscured). Set up a new cashier in Micrsft Dynamics AX 1. Click Retail > Cmmn > Wrkers. 2. Click Hire new wrker, and then type the new cashier's name. 3. Enter infrmatin abut the emplyee n the tabs as needed. 4. In the Wrker frm, click the Retail link, and then select a layut ID and a language fr the emplyee. 5. In the Emplyment type field, select Cashier, and then type a name in the Name n receipt field. 6. In the Passwrd field, type the emplyee's passwrd. 7. Click POS permissins, and then select a psitin fr the cashier. Imprtant When setting up Windws user accunts fr emplyees, and when setting up emplyee accunts in Micrsft Dynamics AX, yu must use a "least privilege" apprach, granting Implementatin Guide fr PCI Cmpliance Part 2: Features that facilitate PCI cmpliance 22

27 emplyees nly thse privileges that they require t perfrm their duties. Fr example, althugh trusted management persnnel might require Administratr privileges n stre cmputers, emplyee lgn accunts must belng t a grup that des nt have these privileges. This helps yu cmply with Requirement 7 f the PCI Data Security Standard. Accrding t Requirement 8.1 f the PCI Data Security Standard, each emplyee must have his r her wn lgn accunt. D nt allw emplyees t share emplyee IDs r passwrds. Fr mre infrmatin abut user accunts fr emplyees, see the Micrsft Dynamics AX 2012 Upgrade Guide, which is available as a dwnlad at Data strage and deletin Several requirements in the PCI Data Security Standard relate t prtecting sensitive cardhlder data. These requirements call fr the safe strage, encryptin, and remval f cardhlder infrmatin, such as magnetic stripe data, card validatin cdes and values, PINs, and PIN blcks. In particular, Requirements 1.3 and prhibit string cardhlder data n servers that are cnnected t the Internet. The database server cannt als be a web server. Micrsft Dynamics AX 2012 helps merchants cmply with the PCI Data Security Standard regarding data strage and retentin in the fllwing ways: Primary accunt numbers (PANs) are nt retained, s n peridic purging is necessary. This helps satisfy Requirement 3.1 f the PCI Data Security Standard. Sensitive authenticatin data is never retained, cannt be reprduced frm within the prgram, and is nt available in lg files r debug files. Credit card numbers are tkenized and secured by the cnnectr fr Payment Services and are never sent t Micrsft Dynamics AX 2012 R2 as plain text. Tkens expire after 120 days frm the last time used. Card numbers are truncated after authrizatin, s that nly the last fur digits remain. Card numbers n bth printed and jurnaled receipts are always truncated. Like this release f Micrsft Dynamics AX 2012, the previus release (Micrsft Dynamics AX fr Retail) did nt retain any sensitive authenticatin data. Cmpliance with Requirement 3.2 f the PCI Data Security Standard des nt require the remval f histrical data. Because cardhlder data is nt retained, n encryptin is required. Therefre, there is n need t peridically delete the encryptin key. This helps satisfy Requirement 3.6 f the PCI Data Security Standard. Data transmissins All Micrsft Dynamics AX 2012 transmissins f cardhlder data, whether ver a private netwrk r a public netwrk, are secured by the use f Secure Sckets Layer (SSL). This helps satisfy Requirement 4.1 f the PCI Data Security Standard. Micrsft Dynamics AX 2012 des nt allw r facilitate the transmissin f PANs via r ther end-user messaging technlgies. Any such transmissin that takes place must be encrypted t satisfy Requirement 4.2 f the PCI Data Security Standard. Implementatin Guide fr PCI Cmpliance Part 2: Features that facilitate PCI cmpliance 23

28 Imprtant Strng cryptgraphy and security prtcls must be used fr data transmissin ver public netwrks. Flw f payment data in Retail POS Figure 1 shws the flw f payment data in the Retail POS system. Figure 1 Payment data flw in Retail POS Implementatin Guide fr PCI Cmpliance Part 2: Features that facilitate PCI cmpliance 24

29 Flw f payment data in Micrsft Dynamics AX Accunts receivable Figure 2 shws the flw f payment data in the Accunts receivable. Figure 2 Payment data flw in Accunts receivable Flw f payment data in a Micrsft Dynamics AX nline stre Figure 3 shws the flw f payment data in a Micrsft Dynamics AX nline stre. Figure 3 Payment data flw in an nline stre Implementatin Guide fr PCI Cmpliance Part 2: Features that facilitate PCI cmpliance 25