Clark University's PCI Compliance Policy
Name: PCI DSS stands for Payment Card Industry Data Security Standard, and is a worldwide security standard assembled by the Payment Card Industry Security Standards Council (PCI SSC).
Purpose: The PCI DSS, a set of comprehensive requirements for enhancing payment account data security, was developed by the founding payment brands of the PCI Security Standards Council (PCI SSC). The PCI SSC is responsible for managing the security standards, while compliance with the PCI set of standards is enforced by the founding members of the Council: American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa Inc.
PCI DSS includes technical and operational requirements for security management, policies, procedures, network architecture, software design and other critical protective measures to prevent credit card fraud, hacking and various other security vulnerabilities and threats. The standards apply to all organizations that store, process or transmit cardholder data.
Reason for the Policy: The standards are designed to protect cardholder information of students, parents, donors, alumni, customers, and any individual or entity that utilizes a credit card to transact business with the University. This policy is intended to be used in conjunction with the complete PCI-DSS requirements as established and revised by the PCI Security Standards Council.
Entities Affected by this Policy: All departments that collect, maintain or have access to credit card information must comply with PCI policy. These currently include:
- Student Accounts – accept and process credit cards for payment of student accounts
- GSOM - accept and process credit cards for payment of student accounts, deposits and application fees
- COPACE – accept credit card for payment of student accounts
- UG Admissions - accept credit card for payment of deposits and application fees that are manually processed by University cashier or third-party vendors
- Graduate Admissions – Geography, English, and IDCE accept credit cards for payment of application fees. Manually processed by University Cashier.
- Development - accept and process credit card donations and alumni events
- IDRISI – accept and process credit cards for purchase of products
- Economic Geography - accept credit cards for subscription costs of publications
- Student Records - accept credit cards for transcript costs
- Physical Plant – accept credit cards for payment of rent
Third Party vendors that process and store credit card information for Clark using Clark's merchant accounts include:
- Harris - Development and Alumni
- Pay Pal – Admissions and GSOM
- Touchnet – Student Accounts, COPACE, GSOM
- Authnet Gateway – IDRISI
Clark also has a relationship with both Sallie Mae and 1st Financial who process application fees by credit card. However, Clark's merchant accounts are not used and no credit card information is received from either vendor.
Who Should Read this Policy: All persons who have access to credit card information, including:
- Every employee that accesses handles or maintains credit card information. Clark University employees include full-, part-time and hourly staff members as well as student workers who access, handle or maintain records
- Employees who contract with service providers (third party vendors) who process credit card payments on behalf of Clark
- IT staff responsible for scanning the University systems to insure no credit card numbers are stored electronically.
Merchant Account - A relationship set up by the Controller's office between the university and a bank in order to accept credit card transactions. The merchant account is tied to a general ledger account to distribute funds appropriately to the organization (owner) for which the account was set up.
Coordinator – The University official who has oversight responsibility for the regulation/standard. Regulation monitors stay abreast of updates to their respective regulations, ensure policies are up to date and notify the Information Security Officer and Data Managers about changes.
Credit Card Data - Full magnetic strip or the PAN (Primary Account Number) plus any of the following:
- Cardholder name
- Expiration date
- Service Code
PCI-DSS - Payment Card Industry Data Security Standard
PCI Security Standards Council - The security standards council defines credentials and qualifications for assessors and vendors as well as maintaining the PCI-DSS.
Self-Assessment - The PCI Self-Assessment Questionnaire (SAQ) is a validation tool that is primarily used by merchants to demonstrate compliance to the PCI DSS.
PAN - Primary Account Number is the payment card number (credit or debit) that identifies the issuer and the particular cardholder account. It is also called Account Number.
Overview: Credit card companies and financial institutions validate that vendors (Clark) are rated based on their volume of transactions. The rating that a company receives determines the process that they must go through in order to be validated. There are four levels of PCI Compliance, with level 1 being the most stringent and level 4 being the least stringent. If a merchant suffers an attack that has caused account data to be compromised, the merchant level requirement goes up to level 1 automatically. Based on the number of credit card transactions processed annually across the campus (less than 20K per year), and the fact that the University has not experienced a breach, Clark would be classified as a Level 4.
University policy prohibits the storing of any credit card information in an electronic format on any computer, server or database including Excel spreadsheets. It further prohibits the emailing of credit card information. Based on this policy, compliance with a number of the PCI Compliance requirements do not apply. The following list communicates the full scope of the compliance requirements but based on the University policy that prohibits storing of credit card information electronically and utilizing third-party vendors for web based credit card processing, some may not be relevant.
- Build and Maintain a Secure Network
- Maintain a Vulnerability Management Program
- Implement Strong Access Control Measures
- Regularly Monitor and Test Networks
- Maintain an Information Security Policy
- Insure Third Party Compliance
- Complete an annual self-assessment
- Perform a quarterly Network scan
Without adherence to the PCI-DSS standards, the University would be in a position of unnecessary reputational risk and financial liability. Merchant account holders who fail to comply are subject to:
- Any fines imposed by the payment card industry
- Any additional monetary costs associated with remediation, assessment, forensic analysis or legal fees
- Suspension of the merchant account.
Clark requires compliance with PCI standards. To achieve compliance, the following requirements must be met by departments accepting credit cards to process payments on behalf of the University.
- Credit card merchant accounts must be approved by the Controller
- Management and employees must be familiar with and adhere to the PCI-DSS requirements of the PCI Security Standards Council.
- Management in departments accepting credit cards must conduct an annual self-assessment against the requirements and report results to the Coordinator. All employees involved in processing credit card payments sign a statement that they have read, understood, and agree to adhere to Information Security policies of Clark University and this policy
- Any proposal for a new process (electronic or paper) related to the storage, transmission or processing of credit card data must be brought to the attention of and be approved by the Controller.
Storage and Disposal
- Credit card information must not be entered/stored on University network servers, workstations, or laptops
- Credit card information must not be transmitted via email
- Web payments must be processed using a PCI-compliant service provider approved by the Controller. Credit card numbers must NOT be entered into a web page of a server hosted on the Clark network
- Although electronic storage of credit card data is prohibited by this policy, the University will perform a quarterly Network scan to insure that the policy has not been violated
- Any paper documents containing credit card information should be limited to only information required to transaction business, only those individuals who have a business need to have access, should be in a secure location, and must be destroyed via approved methods once business needs no longer require retention.
- All credit card processing machines must be programmed to print-out only the last four or first six characters of a credit card number.
- Securely dispose of sensitive cardholder data when no longer needed for reconciliation, business or legal purposes. In no instance shall this exceed 45 days and should be limited whenever possible to only 3 business days. Secured destruction must be via shredding either in house or with a third-party provider with certificate of disposal
- Neither the full contents of any track for the magnetic strip nor the three-digit card validation code may be stored in a database, log file, or point of sale product.
Third Party Vendors (Processors, Software Providers, Payment Gateways, or Other Service Providers)
- The Controller must approve each merchant bank or processing contact of any third-party vendor that is engage in, or propose to engage in, the processing or storage of transaction data on behalf of Clark—regardless of the manner or duration of such activities.
- Insure that all third-party vendors adhere to all rules and regulations governing cardholder information security.
- Contractually require that all third parties involved in credit card transactions meet all PCI security standards, and that they provide proof of compliance and efforts at maintaining ongoing compliance.
- The Coordinator will notify each department head of the time-line to complete and submit the annual assessment.
- The PCI-DSS Self-Assessment Questionnaire must be completed by the merchant account owner annually and anytime a credit card related system or process changes. This assessment is the responsibility of the head of the department approved to accept credit cards.
- Ongoing training programs must be offered to train employees on PCI DSS and importance of compliance
Responsible Organization/Party: The Controller shall serve as the Coordinator of the policy which includes responsibility for notifying the Information Security Officer, applicable Department Heads and Data Managers about changes to the policy. S/he will be assisted by the CIO, the Director of Student Accounts and other University Officers as needed.
Enforcement: The Information Security Officer will oversee enforcement of the policy. Additionally this individual will investigate any reported violations of this policy, lead investigations about credit card security breaches and may terminate access to protected information of any users who fail to comply with the policy. S/he will be assisted by the CIO, Controller, and the Director of Student Accounts as well as other University Officers as needed.
- What Is PCI Compliance and Should Merchants Be Concerned About It?
- PCI Compliance Guide
- PCI DSS Resources
- What You Should Know
Date of Revision: April 6, 2009