University of Wisconsin Oshkosh Payment Card Procedure

Payment Card Industry Data Security Standard (PCI DSS)

Version 1.0

PCI DSS Version 3.2 – University of Wisconsin Oshkosh Payment Card Procedure

Confidential 1 Property of University of Wisconsin Oshkosh

Contents

Revisions/Approvals……………………………………………………………………………………………………………………1 Purpose

PCI DSS

Visa Cardholder Information Security Plan (CISP) MasterCard Site Data Protection Program (SDP)

Scope/Applicability Authority Procedure Procedures and Other Supporting Documents Interpretations Exclusions Glossary

Revisions/Approvals Ver. # Changes By Ver. date Reason

1.0 R. Sitzberger D. Lewis

8/01/2018 Adopted and modified template from CampusGuard v 3.2.2

Property of University of Wisconsin Oshkosh

Purpose This document and additional supporting documents represents University of Wisconsin Oshkosh’s (UW Oshkosh) Procedure to prevent loss or disclosure of sensitive customer information including payment card data. Failure to protect customer information may result in financial loss for customers, suspension of credit card processing privileges, and fines imposed on and damage to the reputation of the unit and the institution.

PCI DSS

The PCI DSS is a mandated set of requirements agreed upon by the five major credit card companies: VISA, MasterCard, Discover, American Express and JCB. These security requirements apply to all transactions surrounding the payment card industry and the merchants/ organizations that accept these cards as forms of payment. Further details about PCI can be found at the PCI Security Standards Council Web site (https://www.pcisecuritystandards.org)

In order to accept credit card payments, UW Oshkosh must prove and maintain compliance with the Payment Card Industry Data Security Standards. The UW Oshkosh Payment Card Procedure and additional supporting documents provide the requirements for processing, transmission, storage, and disposal of cardholder data transactions. This is done in order to reduce the institutional risk associated with the administration of credit card payments by individual departments and to ensure proper internal control and compliance with the Payment Card Industry Data Security Standard (PCI DSS).

Visa Cardholder Information Security Plan (CISP) Visa Inc. instituted the Cardholder Information Security Program (CISP) in June 2001. CISP is intended to protect Visa cardholder data - wherever it resides - ensuring that members, merchants, and service providers maintain the highest information security standard. In 2004, the CISP requirements were incorporated into the Payment Card Industry Data Security Standard (PCI DSS).

MasterCard Site Data Protection Program (SDP) The SDP Program, with the PCI DSS as its foundation, details the data security and compliance validation requirements in place to protect stored and transmitted MasterCard payment account data.

Scope/Applicability The UW Oshkosh Payment Cards Procedure applies to all faculty, staff, students, organizations, third-party vendors using UW Oshkosh’s network, individuals, systems, and networks involved with payment card handling. This includes transmission, storage, and/or processing of payment card data, in any form (electronic or paper), on behalf of UW Oshkosh.

Authority UW Oshkosh policies fall within a greater hierarchy of laws, statutes, and regulations. The Board has been authorized by the State to govern UW Oshkosh. The Board has delegated the authority

Property of University of Wisconsin Oshkosh to manage the institution to the Chancellor. As a part of that management, the Chancellor will direct the development and implementation of UW Oshkosh’s policies and procedures.

Procedure It is the Procedure of UW Oshkosh to allow acceptance of payment cards as a form of payment for goods and services upon written approval from the Controller. UW Oshkosh requires all departments that accept payment cards to do so only in compliance with the PCI DSS and in accordance with this Procedure document, the UW Oshkosh payment card procedures, and other supporting documents.

All entities of UW Oshkosh that receive or expect to receive payments electronically must comply with the guidelines and procedures issued by the Controller. All entities who wish to take payments via payment cards must be reviewed by the PCI Team. Once approved, the request should be forwarded to the Controller for final approval and implementation. All merchants should submit their requests for approval to the appropriate University Business

Officer and then, once approved, forward the signed form to the PCI Team.

Entities accepting payment cards will sign an agreement with the Controller that details their responsibilities, as well as the security requirements (Payment Card Industry Data Security

Standard and institutional Data Security Policies) that must be followed. This agreement may be updated from time to time as requirements change. Failure to follow the requirements of the agreement may result in the revocation of your ability to accept card payments.

Entities must accept only payment cards authorized by Controller and agree to operate in accordance with the contract(s) the UW Oshkosh holds with its Service Provider(s) and the Card Brands. This is to ensure that all transactions are in compliance with the Payment Card Industry Data Security Standards (PCI DSS), Federal Regulations, NACHA rules, service provider contracts, and UW Oshkosh policies regarding security and privacy that pertain to electronic transactions.

Keep cardholder data storage to a minimum by implementing data retention and disposal policies, procedures and processes that include at least the following for all cardholder data (CHD) storage:

Limiting data storage amount and retention time to that which is required for legal, regulatory, and/or business requirements

Data that is not absolutely necessary in order to conduct business will not be retained in any format. All data will be treated as confidential.

Specific retention requirements for cardholder data

Processes for secure deletion of data when no longer needed

A quarterly process for identifying and securely deleting stored cardholder data that exceeds defined retention.

Physical access to data records is restricted to staff with a need to know.

Never type credit card data into a workstation computer.

The controller must approve the use of Wi-Fi for credit card payments. All use of technology must follow the UW System Acceptable Use Policy (25-3 formerly 97-2).

https://www.wisconsin.edu/regents/policies/acceptable-use-of-information-technology-resources/

Property of University of Wisconsin Oshkosh

Cardholder data (CHD) received via fax or end-user messaging technologies (for example, e-mail, instant messaging, SMS, chat, etc.) is never to be used to process a payment. Follow approved departmental procedures for the appropriate method of responding to and securely destroying the cardholder data.

All proposed Processing Equipment is to be reviewed by IT Security by creating a HelpDesk ticket. Exceptions to this Procedure will be limited and will require a business plan (including reason why the available central processing systems will not work for your area) to be submitted and approved by IT Security in advance of any equipment or system purchase.

All payments received must be directed into a UW Oshkosh Approved Bank Account. The type and nature of the electronic transaction (e.g., ACH, Credit Card, Point of Purchase, wire, etc.) will dictate where the transaction will be deposited.

Accounting entries to record the receipt of the payment will be linked directly into the institution’s Shared Financial System (SFS), whenever possible, to ensure timely recording of transactions and expedite the prompt reconcilement of general ledger and bank accounts.

Procedures and Other Supporting Documents UW Oshkosh - PCI Administration and Department Payment Card Procedures

UW Oshkosh - Appendix 1 - PCI Payment Card Security Incident Response Plan

UW Oshkosh - Appendix 2 - PCI Application for New Payment Card Merchants

UW Oshkosh - Appendix 3 - PCI Annual Merchant Survey

UW Oshkosh - Appendix 4 - PCI Payment Card Best Practices

Interpretations The authority to interpret this Procedure rests with the Chancellor and the Financial Services Leadership Team.

Glossary Term Definition

Payment Card Industry Data Security Standards

(PCI DSS)

The security requirements defined by the Payment Card Industry Security Standards Council and the 5 major Credit Card Brands:

Visa, MasterCard, American Express, Discover, JCB

Cardholder Someone who owns and benefits from the use of a membership card, particularly a credit card.

Card Holder Data

(CHD)

Those elements of credit card information that are required to be protected. These elements include Primary Account Number (PAN), Cardholder Name, Expiration Date and the Service Code.

Primary Account Number

(PAN)

Number code of 14 or 16 digits embossed on a bank or credit card and encoded in the card's magnetic strip. PAN identifies the issuer of the card and the account, and includes a check digit as an authentication device.

Cardholder Name The name of the Cardholder to whom the card has been issued.

Expiration Date The date on which a card expires and is no longer valid. The expiration date is embossed, encoded or printed on the card.

Service Code The service code that permits where the card is used and for what.

Sensitive Authentication Data

Additional elements of credit card information that are also required to be protected but never stored. These include Magnetic Stripe (i.e., track) data, CAV2, CVC2, CID, or CVV2 data and PIN/PIN block.

Magnetic Stripe (i.e., track) data

Data encoded in the magnetic stripe or equivalent data on a chip used for authorization during a card-present transaction. Entities may not retain full magnetic-stripe data after transaction authorization.

CAV2, CVC2, CID, or CVV2 data

The three- or four-digit value printed on or to the right of the signature panel or on the face of a payment card used to verify card- not-present transactions.

PIN/PIN block Personal Identification Number entered by cardholder during a card-present transaction, and/or encrypted PIN block present within the transaction message.

Disposal CHD must be disposed of in a certain manner that renders all data un-recoverable. This includes paper documents and any electronic media including computers, hard drives, magnetic tapes, USB storage devices,(Before disposal or repurposing, computer drives should be sanitized in accordance with the (Institution’s) Electronic Data Disposal

Procedure). The approved disposal methods are:

Cross-cut shredding, Incineration, Approved shredding or disposal service

Merchant Department Any department or unit (can be a group of departments or a subset of a department) which has been approved by the (institution) to accept credit cards and has been assigned a Merchant identification number.

Merchant Department Responsible Person

(MDRP)

An individual within the department who has primary authority and responsibility within that department for credit card transactions.

Database A structured electronic format for organizing and maintaining information that is accessible in various ways. Simple examples of databases are tables or spreadsheets

Appendix 1 - Credit Card Security Incident Response Plan

PCI DSS v3.2 - Appendix 1 - Incident Response Plan

Confidential i Property of CampusGuard

Contents

Revisions/Approvals .......................................................................................................................... i Purpose Scope/Applicability Authority

Security Incident Response Team Procedures

Incident Response Plan (IRP) Incident Response Team Procedures Bank Breach Response Plans

Flow Chart for Suspected Breach Symptoms of Data Breaches Card Association Breach Response Plans

Visa – Responding to a Breach MasterCard – Responding to a Breach American Express – Responding to a Breach

Incident Classification, Risk Analysis and Action Matrix Interpretations Definitions

Revisions/Approvals Ver. # Changes By Ver. date Reason

1.0 R. Sitzberger D. Lewis

08/01/2018 Adopted and modified template from CampusGuard

Purpose The Payment Card Security Incident Response Plan supplements the University Incident Response Plan.

To address credit cardholder security, the major card brands (Visa, MasterCard, Discover, and American Express) jointly established the PCI Security Standards Council to administer the Payment Card Industry Data Security Standards (PCI DSS) that provide specific guidelines for safeguarding cardholder information. One of these guidelines requires that merchants create a Security Incident Response Team (Response Team) and document an Incident Response Plan (IRP).

This document defines those responsible, the classification and handling of, and the reporting/notification requirements for incident response plan at the University of Wisconsin Oshkosh (UW Oshkosh ).

Scope/Applicability A list of the merchants and operations with payment card acceptance and IP addresses has been provided to the Information Technology Security Office to identify the areas of accepting payment cards. This procedure is in effect for all departments or persons receive or have access to cardholder data.

Authority

Security Incident Response Team The University of Wisconsin Oshkosh credit card Response Team is comprised of Financial Services and Information Technology. See below for names and contact information.

University of Wisconsin Oshkosh Credit Card Security Incident Response Team Communication for the Response Team can be sent to helpdesk@uwosh.edu.

Name Department/Title Role Telephone Email

Jeanne Schneider AVC/Controller

PCI Committee Chairperson

(920) 424-0717 schneiderj@uwosh.edu

Deborah Matulle Assistant Controller

PCI Team Member

(920) 424-3318 matulle@uwosh.edu

Daphne Lewis Senior Business Analyst

PCI Team Member

(920) 424-2174 lewisdc@uwosh.edu

Jean Wolfgang Bursar PCI Team Member

(920) 424-1442 wolfganj@uwosh.edu

Rachel Grose Bursar Generalist PCI Team Member

(920)424-1336 groser@uwosh.edu

Mark Clements Director of Information Services

PCI Security Lead

(920)424-3020 clementsm@uwosh.edu

Richard Montano IT Specialist PCI IT Specialist (920)424-3020 montanor@uwosh.edu

Procedures

Incident Response Plan (IRP) The Incident Response Plan needs to take into account that incidents may be reported/identified through a variety of different channels but the Incident Response Team will be the central point of contact and responsible for executing UW Oshkosh Incident Response Plan.

The UW Oshkosh security incident response plan is summarized as follows:

1. All incidents must be reported to the Response Team.

2. All actions taken must be documented on the Payment Card Incident Log (appendix A)

3. The Response Team will confirm receipt of the incident notification.

4. The Response Team will investigate the incident and assist the compromised department in limiting the exposure of cardholder data.

5. The Response Team will resolve the problem to the satisfaction of all parties involved, including reporting the incident and findings to the appropriate parties (credit card associations, credit card processors, etc.) as necessary.

6. The Response Team will determine if policies and processes need to be updated to avoid a similar incident in the future.

An ‘incident’ is defined as a suspected or confirmed ‘data compromise’. A ‘data compromise’ is any situation where there has been unauthorized access to a system or network where prohibited, confidential or restricted data is collected, processed, stored or transmitted; Payment Card data is prohibited data. A ‘data compromise’ can also involve the suspected or confirmed loss or theft of any material or records that contain cardholder data.

In the event of a suspected or confirmed incident:

1. Do NOT touch or compromise any possible evidence. Do not shut off any computer or POS system.

2. Contact the Response Team. Make verbal contact with a team member, DO NOT LEAVE A VOICE MAIL. (During business hours contact the HelpDesk at (920)424-3020. After hours, contact University Police)

a. Overview of incident, including date, time, and location of incident

b. Incident Type

i. Computer Abuse

ii. Malicious Code

iii. Spam

iv. Unauthorized Access/Use

v. Breach of Physical Security (unlocked file cabinet, storage room, etc.)

vi. Possible tampering of POS device

vii. Other

c. Intrusion Method

i. Virus

ii. Spyware/Malware

iii. Stolen Password

iv. Other

d. Overview of data on the system? Was it sensitive?

e. Explanation of discovery

f. Action taken upon discovery

g. Explanation of impact and impact on daily activities

h. Any additional information

3. The Response Team will immediately coordinate a response and reply to this initial notification/communication to confirm they are aware of the incident.

4. If the incident involves a payment station (PC used to process credit cards):

a. Do NOT turn off the PC.

b. Disconnect the network cable connecting the PC to the network jack. If the cable is secured and you do not have the key to the network jack, simply cut the network cable.

5. Document any steps taken until the Response Team has arrived. Include the date, time, person/persons involved and action taken for each step.

6. Assist the Response Team as they investigate the incident.

Incident Response Team Procedures The UW Oshkosh Credit Card Security Incident Response Team must be contacted by a department in the event of a system compromise or a suspected system compromise. After being notified of a compromise, the Response Team, along with other designated university staff from Computers and Information Technology, will implement their incident response plan to assist and augment departments’ response plans.

In response to a system compromise, the Response Team and Computers and Information Technology will:

1. Ensure compromised system is isolated on/from the network.

2. Gather, review and analyze all centrally maintained system, firewall, file integrity and intrusion detection/protection system logs and alerts.

3. Assist department in analysis of locally maintained system and other logs, as needed.

4. Conduct appropriate forensic analysis of compromised system.

5. If an incident of unauthorized access is confirmed and card holder data was potentially compromised, the PCI Committee, depending on the nature of the data compromise, must notify the appropriate organizations that may include the following:

a. UW Oshkosh Chief Financial Officer and the Chief Information Officer

b. UW Oshkosh Internal Audit group

c. UW Oshkosh Acquiring Bank(s), the Acquiring Bank will be responsible for communicating with the card brands (VISA, MasterCard)

i. see Bank Breach Response Plan

ii. see Visa – Responding to a Breach

iii. see MasterCard – Responding to a Breach

d. If American Express payment cards are potentially included in the breach the University is responsible for notifying and working with American Express

i. For incidents involving American Express cards, contact American Express Enterprise Incident Response Program (EIRP) within 24 hours after the reported incident.

1. Phone number: (888) 732-3750

2. Email: EIRP@aexp.com.

ii. For more detail see American Express – Responding to a Breach

e. If Discover Network payment cards are potentially included in the breach the University is responsible for notifying and working with Discover Network.

i. If there is a breach in your system, notify Discover Security within 48 hours.

1. Phone Number: (800) 347-3083

ii. For more details see Discover Network – Fraud Prevention FAQ

f. Campus police and local law enforcement

6. Assist card industry security and law enforcement personnel in investigative process.

Bank Breach Response Plans The credit card companies have specific requirements the Response Team must address in reporting suspected or confirmed breaches of cardholder data. For Visa and MasterCard it is the University’s responsibility to notify their own bank (the financial institution(s) that issues merchant accounts to the university) and the University’s bank will be responsible for notifying Visa and MasterCard, were applicable.

http://www.discovernetwork.com/merchants/fraud-protection/fraud-faq.html#how-can-i-protect-my-business-and-customers-from-hacking-attacks

Flow Chart for Suspected Breach

Acknowledge receipt of suspected breach

Banking Partner, Card Association, 3rd-party

Security Firm Central IT Department/Merchant

SUSPICIOUS ACTIVITY REPORTED

BREACH

SUSPECTED

- Do NOT turn off the PC/server

- Disconnect PC/server from network

- Document

- Suspicious activity

- Steps taken to-date

- Personnel involved

- Notify Response Team

- Confirm/research breach

- Ensure system(s) are isolated

- Gather/log central evidence (firewalls, file integrity, IDS, AV, etc)

- Analyze local machines/logs

- Forensic analysis on breached PC

- Prepare INITIAL incident report and notify

- Executive committee & Internal Audit

- University Police & Law Enforcement

- Acquiring Bank and Card Brands

- Continue/assist with on-going investigation

Incident Response Team

- Issue FINAL incident report

- Prioritize/complete any remediation items

Symptoms of Data Breaches Detecting date breaches is a difficult task that requires planning, diligence and participation from staff from multiple departments across the institution. While there are systems that can be implemented to provide automated monitoring to look for symptoms of breaches there are also some symptoms that may be detected by staff during the course of their normal, daily activities.

A system alarm or similar indication from an intrusion detection tool

Unknown or unexpected outgoing Internet network traffic from the payment card environment

Presence of unexpected IP addresses or routing

Suspicious entries in system or network accounting

Accounting discrepancies (e.g. gaps in log-files)

Unsuccessful logon attempts

Unexplained, new user accounts

Unknown or unexpected services and applications configured to launch automatically on system boot

Anti-virus programs malfunctioning or becoming disabled for unknown reasons

Unexplained, new files or unfamiliar file names

Unexplained modifications to file lengths and/or dates, especially in system executable files

Unexplained attempts to write to system files or changes in system files

Unexplained modification or deletion of data

Denial of service or inability of one or more users to log in to an account

System crashes

Poor system performance

Unauthorized operation of a program or sniffer device to capture network traffic

Use of attack scanners, remote requests for information about systems and/or users, or social engineering attempts

Unusual time of usage

Unauthorized wireless access point detected

Card Association Breach Response Plans

Visa – Responding to a Breach Follow the steps set forth in the resource:

http://usa.visa.com/download/merchants/cisp-what-to-do-if-compromised.pdf

Initial Steps and Requirements for Visa Clients (Acquirers and Issuers) (A full description of the steps is available at the link listed above)

Notification

1. Immediately report to Visa the suspected or confirmed loss or theft of Visa cardholder data.

Clients must contact the Visa Risk Management group immediately at the appropriate Visa region.

2. Within 48 hours, advise Visa whether the entity was in compliance with PCI DSS and, if applicable, PCI PA-DSS and PCI PIN Security requirements at the time of the incident. If so, provide appropriate proof.

Preliminary Investigation

3. Perform an initial investigation and provide written documentation to Visa within three (3) business days. The information provided will help Visa understand the potential exposure and assist entities in containing the incident. Documentation must include the steps taken to contain the incident.

MasterCard – Responding to a Breach The MasterCard Account Data Compromise User Guide sets forth instructions for MasterCard members, merchants, and agents, including but not limited to member service providers and data storage entities regarding processes and procedures relating to the administration of the MasterCard Account Data Compromise (ADC) program.

http://www.mastercard.com/us/merchant/pdf/Account_Data_Compromise_User_Guide.pdf

American Express – Responding to a Breach Merchants must notify American Express immediately and in no case later than twenty-four (24) hours after discovery of a Data Incident.

To notify American Express, please contact the American Express Enterprise Incident Response Program (EIRP) toll free at (888) 732-3750/US only, or at 1-(602) 537-3021/International, or email at EIRP@aexp.com. Merchants must designate an individual as their contact regarding such Data Incident.

For more complete language on the obligations of merchants and service providers see the following 2 documents:

American Express® Data Security Operating Policy for Service Providers https://merchant-channel.americanexpress.com/merchant/en_US/data-security

American Express Data Security Operating Policy – U.S.

https://icm.aexp-static.com/Internet/NGMS/US_en/Images/DSOP_Merchant_US.pdf

American Express Data Security Operating Policy – Australia https://icm.aexp-static.com/Internet/NGMS/alpha/webstatic/dashboard/pdf/au/en/datasecurity/DSOP_Merchant_Australia_Oct17.pdf http://usa.visa.com/download/merchants/cisp-what-to-do-if-compromised.pdf http://www.mastercard.com/us/merchant/pdf/Account_Data_Compromise_User_Guide.pdf https://merchant-channel.americanexpress.com/merchant/en_US/data-security https://icm.aexp-static.com/Internet/NGMS/US_en/Images/DSOP_Merchant_US.pdf https://icm.aexp-static.com/Internet/NGMS/alpha/webstatic/dashboard/pdf/au/en/datasecurity/DSOP_Merchant_Australia_Oct17.pdf https://icm.aexp-static.com/Internet/NGMS/alpha/webstatic/dashboard/pdf/au/en/datasecurity/DSOP_Merchant_Australia_Oct17.pdf

Incident Classification, Risk Analysis and Action Matrix Each incident should be reviewed based on the risk and action matrix, which attempts to reflect the severity of the incident and its impact. Then, decisions on whether to develop further controls and processes can be made so work-tickets can be created and prioritized so that identified vulnerabilities are addressed.

Security Problem Unlawful

Activity

Violation of

Appropriate

Usage Policy

Data

Disclosure

Network

Device

Compromises

Vulnerabilities

PCI-DSS Breach

Distribution of Copyrighted Material

Breach of HIPPA

Breach of Telecommunications Act

Confidential data at risk of disclosure to the

Internet.

Highly Confidential of a personal nature data at risk of disclosure to the network.

Confidential data, of a personal nature at risk of disclosure to the network.

Network resources providing un-authenticated access to data not intended for public distribution.

Tools installed which present a significant risk to network stability

Malicious Software eg. Virus/Trojan. No

User Interaction required for infection

Port scanning 2 2

Unauthorised Publishing Service that can be used for content distribution. Eg. FTP

Server.

Malicious Software eg. Virus/Trojan. User interaction required for infection.

Vulnerability more than one week old that allows arbitrary code to be run

Highly Insecure Configuration 4

Vulnerability less than one week old that allows arbitrary code to be run

Security Problem Family

Action

Class Actions to be taken by Response Team Escalation Process

Default Action

Period

1 - If required, completely block all network access.

- Phone call to Response Team to notify of the problem, if

IT Security and Risk Officer unavailable, call to CIO or

Senior Manager

- If required, duplicate disks

- For network device compromise notify Regional CERT

(US-CERT or AUS-CERT) of suspected source IP.

- If action not completed in required time, Alert CIO and/or

Senior Management of the affected area. 1 Hour

2 - If required, block direct Internert access.

- Verbal contact with Response Team.

- Phone call to IT Security and Risk Officer to notify of the problem.

- For network device compromise notify Regional CERT

(US-CERT or AUS-CERT) of suspected source IP.

- If required, duplicate disks

- If action not completed in required time, escalate to Class 1

- Alert Service, System or

Application Manager as appropriate.

2 Hours

3 - Verbal contact with Response Team.

- Phone IT Security Officer for region.

- For network device compromise notify Regional CERT

(US-CERT or AUS-CERT) of suspected source IP.

- If action not completed in required time, escalate to Class 2 4 Hours

4 - Verbal contact with Response Team. - If action not completed in required time, escalate to Class 3 1 Day

5 - Verbal contact with Response Team. - If action not completed in required time, escalate to Class 4

- If a network device is compromised escalation is to Class

1 Week

Interpretations The authority to interpret this procedure rests with the Chancellor and the Finance and Administration Leadership Team.

Definitions Term Definition

Payment Card Industry Data Security Standards

(PCI DSS)

The security requirements defined by the Payment Card Industry Security Standards Council and the 5 major Credit Card Brands:

Visa, MasterCard, American Express, Discover, JCB

Cardholder Someone who owns and benefits from the use of a membership card, particularly a credit card.

Card Holder Data

(CHD)

Those elements of credit card information that are required to be protected. These elements include Primary Account Number (PAN), Cardholder Name, Expiration Date and the Service Code.

Primary Account Number

(PAN)

Number code of 14 or 16 digits embossed on a bank or credit card and encoded in the card's magnetic strip. PAN identifies the issuer of the card and the account, and includes a check digit as an authentication device.

Cardholder Name The name of the Cardholder to whom the card has been issued.

Expiration Date The date on which a card expires and is no longer valid. The expiration date is embossed, encoded or printed on the card.

Service Code The service code that permits where the card is used and for what.

Sensitive Authentication Data

Additional elements of credit card information that are also required to be protected but never stored. These include Magnetic Stripe (i.e., track) data, CAV2, CVC2, CID, or CVV2 data and PIN/PIN block.

Magnetic Stripe (i.e., track) data

Data encoded in the magnetic stripe or equivalent data on a chip used for authorization during a card-present transaction. Entities may not retain full magnetic-stripe data after transaction authorization.

CAV2, CVC2, CID, or CVV2 data

The three- or four-digit value printed on or to the right of the signature panel or on the face of a payment card used to verify card- not-present transactions.

PIN/PIN block Personal Identification Number entered by cardholder during a card-present transaction, and/or encrypted PIN block present within the transaction message.

Disposal CHD must be disposed of in a certain manner that renders all data un-recoverable. This includes paper documents and any electronic media including computers, hard drives, magnetic tapes, USB storage devices,(Before disposal or repurposing, computer drives should be sanitized in accordance with the (Institution’s) Electronic Data Disposal Procedure). The approved disposal methods are:

Cross-cut shredding, Incineration, Approved shredding or disposal service

Merchant Department Any department or unit (can be a group of departments or a subset of a department) which has been approved by the (institution) to accept credit cards and has been assigned a Merchant identification number.

Merchant Department Responsible Person

(MDRP)

An individual within the department who has primary authority and responsibility within that department for credit card transactions.

Database A structured electronic format for organizing and maintaining information that is accessible in various ways. Simple examples of databases are tables or spreadsheets.

Wireless Access Point Also referred to as “AP.” Device that allows wireless communication devices to connect to a wireless network. Usually connected to a wired network, it can relay data between wireless devices and wired devices on the network.

Appendix A. Payment Card Incident Log In the event of a suspected or confirmed, please follow the procedures below ensuring each step taken is documented using this incident log:

1. Start a new payment card incident log. Name and phone number of person reporting incident.

2. Contact the Response Team by sending an email documenting the incident to helpdesk@uwosh.edu or (920)424-3020

3. The Response Team will immediately coordinate a response and reply to this initial notification/communication to confirm they are aware of the incident.

4. If the incident involves a payment station (PC used to process credit cards):

a. Do NOT turn off the PC.

b. Disconnect the network cable connecting the PC to the network jack. If the cable is secured and you do not have the key to the network jack, simply cut the network cable.

5. Document any steps taken until the Response Team has arrived. Include the date, time, person/persons involved and action taken for each step.

6. Assist the Response Team as they investigate the incident.

7. If an incident of unauthorized access is confirmed and card holder data was potentially compromised, the PCI Committee Chairperson will make the following contacts with UW Oshkosh acquiring bank(s) after informing the Chief Financial Officer and the Chief Information Officer:

a. For incidents involving Visa, MasterCard or Discover network cards, contact Elavon within 72 hours or reported incident.

YES NO

If YES, date and time systems were removed:

Name of person(s) who disconnected the network:

If NO, state reason:

Actions Performed

Action Date/Time Location Person (s) performing action

Person(s) documenting action

Additional notes mailto:helpdesk@uwosh.edu

Action Date and Time Location performing action documenting action

Administration and Department Procedures Payment Card Procedures:

Appendix 2 – Application for New Payment Card Merchants

Appendix 2 – Application for New Payment Card Merchants

Contents

Revisions/Approvals Purpose Best Practices for Offices Accepting Payments Cards

1.0 D. Lewis and R. Grose

To be completed by departments that would like to accept payment cards (Visa, Master Card, American Express, Discover cards and debit cards) as a form of payment for goods and/or services, receipt of donations, non-tuition courses, conferences, seminars, tickets and other approved University of Wisconsin Oshkosh (UW Oshkosh) related products.

Please read Payment Card Handling Procedure and Payment Card Procedures prior to completing this application to make sure that your department will be able to comply with all the requirements listed in this Procedure.

Application must be submitted to the PCI Team. Once the application has been approved, please contact the PCI team and your vendor to determine the timeline for installation and set-up. The information provided on this application will be used to create an “Merchant Profile” that will be submitted to our bank, American Express, and Discover Business Services to request merchant numbers. For assistance or questions regarding this form, please contact the PCI Compliance Coordinator at pci@uwosh.edu.

Best Practices for Offices Accepting Payments Cards We understand that complying with the PCI DSS may be difficult and confusing for some departments. If you have identified a business need that requires you to accept credit and/or debit card payments, we recommend that you review this set of high-level best practices before you complete this application.

1. If you don’t need it, don’t store it!

Many offices retain cardholder data (CHD) “just because.” If you keep the transaction number and date, you can always ask the acquiring bank for the CHD if you need it.

This includes paper and forms. Once the transaction has been processed, destroy the CHD on the form. This may require a redesign of the form to move the CHD to the bottom where it can be properly removed and cross-cut shredded.

2. Proper destruction

All forms or paper with CHD should be shredded in a “cross-cut” type shredder.

Third-party shredding services may be used, providing the bins that they provide are secure and cannot be removed from the area. Tracking chain of custody with the CHD and receiving a certificate of secure destruction is also recommended.

3. Online Payment Card Systems

Many departments employ the use of third-party payment systems to outsource card processing to an online process. Many times it is considered good customer service to take phone calls, emails or some other form of communication to process a credit card transaction.

a. Never accept cardholder data that is sent via email; refer to the Payment Procedure for the approved method of response for this type of situation.

b. It is not recommended to act as the customer and input their data for them. It would be better to verbally walk them through the flow as they enter in their data on the website themselves.

c. If you choose to accept payment data over the telephone, transactions should be conducted on a separate (isolated) computer or via a dial-up payment terminal. Do not type credit card data in to your workstation computer.

4. Maintain clean desk policy

CHD should not be left out on desks or in open areas when not needed. Even if leaving the desk for a short period, staff should keep material in a folder and lock the folder in the desk when they leave temporarily. At the end of the day, all CHD should be stored in a secure file cabinet or safe.

5. Electronic storage of CHD

Do not copy or type CHD into spreadsheets or documents on general use workstations even for temporary use. Even if you don’t save the document, an image or file of the data is stored on the hard drive.

6. Never email Credit Card information

Staff should never use email as a manner of transmitting Cardholder data

Should a customer email their credit card information:

a. Reply to the sender, deleting the credit card information from the reply and inform them that “for their protection and UW Oshkosh’s, policies dictate that credit card information shall not be accepted via email. Please use one of our accepted methods of processing your information: (in-person, online, fax, form, etc.).”

7. Do not allow unauthorized persons unaccompanied access to areas where credit card data is stored or processed

This includes other UW Oshkosh staff. As an example, maintenance and janitorial staff should not be permitted in secure areas unaccompanied. This sometimes requires a change in service times.

8. Document Desk Procedures

To insure continuity when office personnel are out, have all individuals document their daily procedures for their role in the handling of confidential data. Include such items as receipt and processing procedures, disposition and destruction of CHD, and storage and transfer of forms within the office.

1. DEPARTMENT INFORMATION:

DEPARTMENT NAME:

MERCHANT (LOCATION) NAME:

Note: The merchant (location) name will appear on your customer’s monthly statements and on the bank statements sent to the Controller’s Office

INTERNET ADDRESS:

Note: The merchant (location) name will appear on your customer’s monthly statements and on the bank statements sent to the Controller’s Office

MERCHANT (LOCATION) ADDRESS:

Note: Merchant address must include Building & Room number. Statements will be mailed to this address.

Device Location: ___________________________________________________

Note: Please provide a map of your location, including where the device is location and any security measures (locked doors, cameras)

2. PRIMARY CONTACT INFORMATION:

CONTACT NAME: MAIN TELEPHONE #:

CONTACT TITLE: ALT. TELEPHONE #:

EMAIL ADDRESS: FAX NUMBER:

Note: Primary contact will be responsible for the overall process of accepting payment cards at this location and must be a full time employee. (Work Study employees are not allowed).

3. MERCHANT INFORMATION:

GIVE A BRIEF DESCRIPTION OF YOUR PAYMENT CARD BUSINESS:

(What is the main purpose of this merchant account? For example, registration fees, tuition for non-credit courses, tickets for events)

DATE SUBMITTED: DESIRED “LIVE” DATE:

TRANSACTION TYPE TO BE ACCEPTED (Mark with an X):

( ) VISA ( ) AMERICAN EXPRESS ( ) DEBIT

( ) MASTERCARD ( ) DISCOVER

ESTIMATED ANNUAL CREDIT CARD VOLUME:

Total Annual Dollar Amount: $

Average Amount per Transaction: $

Annual Number of transactions:

DEPARTMENT ACCEPTS PAYMENT CARDS (Check all that apply):

( ) IN PERSON

( ) BY PHONE

( ) BY MAIL (submit form design to PCI Team)

( ) ONLINE VIA UNIVERISTY’S APPROVED INTERNET PROCESSOR

( ) OTHER, NAME:

PROCESSING SYSTEMS (Check the types of system currently being used or will be used):

( ) POS Terminals ( ) Internet (Online) ( ) Other If Other, describe in detail:

Current Third Party Vendor, if applicable:

IF PROCESSING USING A POINT OF SALE (POS) ELECTRONIC TERMINAL, PLEASE PROVIDE:

MODEL FIRMWARE/SOFTWARE VER. SERIAL NUMBER

4. PROCESSING INFORMATION

These items will be required before implementation…

Yourself, or your employees, have received training on how to handle cardholder data in a compliant manner.

Your department has written instructions on how handle cardholder data in a compliant manner for all employees to review.

All documents that contain sensitive payment card information are destroyed using a crosscut shredder immediately after the transaction is processed.

Payment card numbers are truncated on the receipt.

The {technology used} is kept in a secured and restricted area, away from public access.

The {technology used} is inspected on a regular, periodic basis for tampering and/or substitution.

A “unique code” is assigned to each person with access to payment card processing and is this code not shared with another person.

Is the {technology used} connected to an analog line?

YES

) NO

If NO, please explain

UW Oshkosh’s “Payment Card Processing Procedures” is being followed by employees involved in payment card handling?

Employees are educated on practices for accepting and processing payment cards and closing out batches?

All transactions and settle batches are audited by yourself or an employee daily.

There is a back-up to process transactions daily in your absence.

You, or your employees, are taking every measure possible to prevent duplicate entries.

All employees are educated on common types of payment card fraud and how to counteract them.

All employees are educated on common types of merchant mistakes and how to avoid them.

Background checks are required for employees involved in payment card processing, or employees that have access to such data.

Employees are required to acknowledge, at least annually, that they have read, understood, and agreed to abide by the UW Oshkosh’s policies and procedures on payment card processing by completing the Employee Statement of Understanding.

You have the ability to process payment cards if normal modes of processing are down.

The number of employees who process payment cards are limited to appropriate employees based on their job duties.

The PCI Team is aware of any changes in your payment card program.

Access to stored cardholder data is restricted to users on a need to know basis

When an employee leaves the Department, his/her access to payment card processing is immediately revoked?

The storage of cardholder data and other sensitive information is prohibited.

Storage of the full contents of any track from the magnetic stripe (on the back of the card) in a database, log files, or point of sale products is prohibited.

The storage of the card validation code (3 digit value printed on the signature panel of a

The transmission of CHD via insecure mediums, e.g. fax, email, or chat is prohibited.

The “Privacy Policy” is updated to reflect changes and keep it current.

The “Refund Policy” is updated to reflect changes and keep it current.

5. TECHNICAL INFORMATION:

All staff members who process payment cards aware of the “Emergency Contact Plan” in case the system has been breached or compromised.

All staff members are trained and tested on the Emergency Contact Plan, at least annually? (same as #1)

Default security settings, accounts, and passwords are changed on production systems before taking the system into production?

Transmission of cardholder data and other sensitive information across public networks is encrypted using PCI-approved methods?

On all systems that are commonly affected by malware, anti-malware software is installed on all servers and workstations involved in payment processing, and is it regularly updated?

6. THIRD PARTY PROCESSORS OR GATEWAYS INFORMATION:

If you are not using a Third Party Processor or Gateway, please go to PART 7.

A list of service providers (vendors) is maintained, including a description of the service(s) provided.

Your department has written agreement with an acknowledgment that indicates that the service provider (vendor) is responsible for the security of cardholder data.

The written agreement has been reviewed and approved by our Purchasing

Department.

The written agreement has been reviewed and approved by Information Technology.

A program is in place to validate the service provider's (vendor's) PCI DSS compliance status before engaging in a new relationship.

A program is in place to validate the service provider's (vendor's) PCI DSS compliance on at least an annual basis.

Information is maintained about which PCI DSS requirements are managed by the service provider (vendor), and which are managed by the merchant.

7. EMPLOYEE ATTESTATION STATEMENT

I attest that the information in this merchant questionnaire has been completed to the best of my knowledge and belief. I understand the intent of this merchant questionnaire and that the information I have provided is an important element of UW Oshkosh’s Payment Card Handling Procedure.

I attest that I have read UW Oshkosh’s policies, procedures and guidelines listed under the “Related Information” section of the UW Oshkosh Payment Card Handling Procedure.

I understand that payment card processing information is to be kept in the strictest of confidence to protect cardholder information and that failure to comply with UW Oshkosh’s Payment Card Handling Procedure may result in disciplinary action, up to and including termination.

I further understand that accepting card holder data via insecure methods (fax, email, chat…etc) is prohibited by UW Oshkosh procedure.

I confirm that I have read, understood, and agree to abide by the policies and procedures associated with accepting and handling payment cards on behalf of UW Oshkosh.

Authorized Signature: Date:

Printed Name: Telephone #:

Title: UW Oshkosh ID:

Appendix 3 – Annual Merchant Survey

1. DEPARTMENT INFORMATION:

DEPARTMENT NAME:

MERCHANT (LOCATION) NAME:

Note: The merchant (location) name will appear on your customer’s monthly statements and on the bank statements sent to the Controller’s Office

INTERNET ADDRESS:

Note: The merchant (location) name will appear on your customer’s monthly statements and on the bank statements sent to the Controller’s Office

MERCHANT (LOCATION) ADDRESS:

Note: Merchant address must include Building & Room number. Statements will be mailed to this address.

Device Location: ___________________________________________________

Note: Please provide a map of your location, including where the device is location and any security measures (locked doors, cameras)

2. PRIMARY CONTACT INFORMATION:

CONTACT NAME: MAIN TELEPHONE #:

CONTACT TITLE: ALT. TELEPHONE #:

EMAIL ADDRESS: FAX NUMBER:

Note: Primary contact will be responsible for the overall process of accepting payment cards at this location and must be a full time employee. (Work Study employees are not allowed).

3. MERCHANT INFORMATION:

GIVE A BRIEF DESCRIPTION OF YOUR PAYMENT CARD BUSINESS:

(What is the main purpose of this merchant account? For example, registration fees, tuition for non-credit courses, tickets for events)

DATE SUBMITTED: DESIRED “LIVE” DATE:

TRANSACTION TYPE TO BE ACCEPTED (Mark with an X):

( ) VISA ( ) AMERICAN EXPRESS ( ) DEBIT

( ) MASTERCARD ( ) DISCOVER

ESTIMATED ANNUAL CREDIT CARD VOLUME:

Total Annual Dollar Amount: $

Average Amount per Transaction: $

Annual Number of transactions:

DEPARTMENT ACCEPTS PAYMENT CARDS (Check all that apply):

( ) IN PERSON

( ) BY PHONE

( ) BY MAIL (submit form design to PCI Team)

( ) ONLINE VIA UNIVERISTY’S APPROVED INTERNET PROCESSOR

( ) OTHER, NAME:

PROCESSING SYSTEMS (Check the types of system currently being used or will be used):

( ) POS Terminals ( ) Internet (Online) ( ) Other If Other, describe in detail:

Current Third Party Vendor, if applicable:

IF PROCESSING USING A POINT OF SALE (POS) ELECTRONIC TERMINAL, PLEASE PROVIDE:

MODEL FIRMWARE/SOFTWARE VER. SERIAL NUMBER

4. PROCESSING INFORMATION

These items will be required before implementation…

Yourself, or your employees, have received training on how to handle cardholder data in a compliant manner.

Your department has written instructions on how handle cardholder data in a compliant manner for all employees to review.

All documents that contain sensitive payment card information are destroyed using a crosscut shredder immediately after the transaction is processed.

Payment card numbers are truncated on the receipt.

The {technology used} is kept in a secured and restricted area, away from public access.

The {technology used} is inspected on a regular, periodic basis for tampering and/or substitution.

A “unique code” is assigned to each person with access to payment card processing and is this code not shared with another person.

Is the {technology used} connected to an analog line?

YES

) NO

If NO, please explain

UW Oshkosh’s “Payment Card Processing Procedures” is being followed by employees involved in payment card handling?

Employees are educated on practices for accepting and processing payment cards and closing out batches?

All transactions and settle batches are audited by yourself or an employee daily.

There is a back-up to process transactions daily in your absence.

You, or your employees, are taking every measure possible to prevent duplicate entries.

All employees are educated on common types of payment card fraud and how to counteract them.

All employees are educated on common types of merchant mistakes and how to avoid them.

Background checks…