Schedule G - Electronic Receipt Processing Standard.pdf

State of Michigan Technical Standard Page 1 of 2

1340.00.170.02 Electronic Receipt Processing Standard

State of Michigan Technical Standard

1340.00.170.02 ELECTRONIC RECEIPT PROCESSING STANDARD

Issued: 02/18/2011 Revised: 11/07/2016 Reviewed: 10/31/2024 Next Review Date (1 yr): 10/31/2025

Authoritative Policy: 1340.00 Information Technology Information Security Policy Associated Procedures:

Distribution: Statewide

PURPOSE

To establish a statewide standard for interaction with the state of Michigan (SOM) commerce applications for electronic receipting and use of the Centralized Electronic Payment Authorization System (CEPAS). CEPAS is the SOM approved electronic solution for the receipt of credit/debit card and electronic check through the Automated Clearing House (ACH).

CONTACT/OWNER

Department of Technology, Management and Budget (DTMB) Cybersecurity and Infrastructure Protection (CIP) and Michigan Department of Treasury

SCOPE

Applicable to all SOM information technology (IT) systems that process commerce-related electronic payments. The scope of this standards is to identify and define the following:

• Development standards for determining compliance.

• Ensure that standards are followed.

• Ensure standards are updated as needed.

• The standard applies to electronic systems which accept payment for commerce-related activities such as goods, services, licenses and permits.

STANDARD

All electronic commerce applications that allow for electronic receipt of credit/debit card transactions and electronic checks (ACH) must be processed via CEPAS.

Furthermore, all electronic commerce applications that process or transmit cardholder data shall be developed and maintained in accordance with the current Payment Card Industry (PCI) Data Security Standards (DSS). Agencies using vendor software that processes or transmits cardholder data must ensure that the software is Payment Application Data Security Standards (PA-DSS) compliant.

https://www.michigan.gov/dtmb/-/media/Project/Websites/dtmb/Law-and-Policies/Admin-Guide/1300/POLICY-1340-Information-Technology-Information-Security.pdf

State of Michigan Technical Standard Page 2 of 2

1340.00.170.02 Electronic Receipt Processing Standard

To minimize the risk to the SOM, full credit/debit card numbers, sensitive authentication data, and full bank account information must never be stored on SOM-owned IT Resources.

Service providers with environments outside of SOM resources, that process, transmit or store cardholder data on behalf of the SOM, shall be compliant with the current PCI DSS prior to engagement and must certify compliance annually.

Agencies must contact the Department of Treasury, Office of Financial Services prior to developing, contracting for development, or placing into service any electronic receipting solution.

Any deviation from the Electronic Receipt Processing Standard requires an exception.

CEPAS EXCEPTION PROCESS

Agencies seeking to use an electronic payment application other than CEPAS (SOM standard), must prepare a business case describing the background and the obstacles that prohibit the use of CEPAS.

Please contact Treasury at 517-636-5400 to discuss receipting and/or exception processes.

The CEPAS Program Manager will analyze the business case and prepare a summary document with a recommendation for the PCI Steering Committee’s review. The Department of Treasury’s Deputy State Treasurer will consider the PCI Steering Committee’s feedback and make the final decision on whether an exception will be granted. The time period for each exception will be determined on a case-by-case basis.

Exceptions to CEPAS usage granted by Treasury must be documented in an Enterprise Architecture Solution Assessment (EASA) and if applicable the DTMB-0184 Infrastructure Services Request (ISR). For requesting an exception, see process described above.

APPROVING AUTHORITY

David B. Behen, Director Revised: 11/7/2016

Approving Authority