category:

PCI DSS

Article

A Well Run PCI Program: How Do They Do It?

How are organizations successfully monitoring and maintaining ongoing compliance efforts? Regardless of their size, it requires a daily, coordinated focus and must be actively maintained.

PCI DSS
Read More about the A Well Run PCI Program: How Do They Do It?
Article

Updated Industry Guidance on Accepting Telephone Payments

The move towards VoIP technology has created multiple concerns and uncertainties for PCI compliance. If phone calls include the transmission of cardholder data, whether spoken or keyed in, that data is in scope for PCI DSS.

PCI DSS
Read More about the Updated Industry Guidance on Accepting Telephone Payments
Article

Oversight for Campus Affiliates

Along with your campus departments that are processing credit card payments using a merchant ID issued by your acquirer, it is important for your PCI program to incorporate oversight of the compliance efforts of all campus affiliates.

PCI DSS
Read More about the Oversight for Campus Affiliates
Article

Checklist for Third-Party Service Providers

As you are evaluating potential third-party vendors, you may want to reference this quick checklist to make sure you have all of your PCI “ducks in a row”

Third-Party Service Providers
PCI Third-Party Checklist about the Checklist for Third-Party Service Providers
Article

Crowdfunding on Campus – Considerations for PCI

With regards to PCI compliance, we did want to share some basic guidance on what to evaluate before launching a crowdfunding campaign for your organization.

PCI DSS
Read More about the Crowdfunding on Campus – Considerations for PCI
Article

Requirement 9.9: A How To Guide for Device Inspections

Although your general information security training may briefly discuss attack methods like skimming, you should create a specific program around Requirement 9.9 for any department or merchant accepting in-person transactions.

PCI DSS
Read More about the Requirement 9.9: A How To Guide for Device Inspections
Article

Internal Audit’s Role in Information Security

A large part of an Internal Auditor’s job is to keep current with regulatory standards, and ensure the executive level team is aware of any potential regulatory violations that could result in significant fines or losses.

Compliance
Read More about the Internal Audit’s Role in Information Security
Article

Are Student Organizations Putting Your Reputation at Risk?

Student or faculty organizations that begin accepting payment cards for dues, events, or other activities may not fall directly into your PCI scope but they should be managed similar to all other merchants (e.g. required to follow University policies) to avoid having rogue merchants.

PCI DSS
Read More about the Are Student Organizations Putting Your Reputation at Risk?
Article

Vendor Contract Language: Strengthening your Service Provider Agreements

Contracts should contain language that asserts the service provider is currently PCI compliant, will maintain that compliance, and will protect all sensitive data while in their possession. The following sections should be included in all contracts:

PCI DSS
Read More about the Vendor Contract Language: Strengthening your Service Provider Agreements