Payment Card Industry (PCI) Rules and Standards

Transcript:Payment Card Industry (PCI) Rules and Standards:
Payment Card Industry (PCI) Rules and Standards Training for KSU Departments and Individuals Processing Transactions with Payment Cards Introduction to PCI Payment Card Industry (PCI) standards were designed to prevent credit card fraud and breaches of credit card information, and require that all aspects of the credit card processing transaction be secure. Payment Card companies (such as Visa, MasterCard) can punish violators by revoking card processing privileges, fining the University (up to $500,000 per violation or incident), and requiring on-site compliance auditing by a certified external security auditor. The University would be liable for notification costs and cleanup (to reimburse cardholders for losses incurred) in the event of a data security breach of cardholder data. The University would also suffer a serious loss of consumer confidence in our ability to protect sensitive data. Who do the PCI Requirements Apply to? Anyone involved in any part of processing credit card transactions must understand and follow the PCI requirements. The number of credit card transactions a department processes does not matter. Even if you only process a handful of card transactions a year the PCI requirements still have to be followed. We all share an interest and a responsibility to protect cardholder data at the university. PCI Data Security Rules for Departments Taking Payment Cards All Kansas State University departments that accept, process, store, and transmit payment card data must comply with the Payment Card Industry security standards to ensure the security of cardholder data processed by K-State. PCI standards apply to all types of payments, including in-person, mail, telephone, and web transactions. K-State’s Policy and Procedures Manual 6115 covers Credit Card Processing. K-State is committed to maintaining the security of customer information, including payment cardholder number, name, expiration date and verification number, and follows best practices for protecting payment card information. The Division of Financial Services and the Office of Information Security & Compliance work with all departments to ensure compliance for all merchant IDs. Please note that the PCI data security rules change over time as new versions of the PCI Data Security Standard (PCI DSS) are released. Methods to Accept Credit Cards If proper procedures are followed, credit cards can be accepted via… Online Storefronts - Departments are required to work with the Office of Information Security and Compliance and the Division of Financial Services Systems to accept on-line credit card payments. In Person By Phone Process transaction while