The Payment Card Industry Security Standards Council (PCI SSC) established the Payment Card Industry Data Security Standards (PCI DSS), current version 3.2.1, to help protect consumers’ high-risk payment card data. The PCI DSS requires all organizations that process, transmit and store payment card information to comply with a set of data controls, establish IT and physical security measures, and meet policy requirements to mitigate the risk of a security breach or the loss, theft, or abuse of payment card data.
The standard applies to all organizations that process cardholder information. As such an organization, Stanford University's compliance with PCI DSS is mandatory.
Any third-party vendor engaged by Stanford merchants to process payment card transactions on their behalf, or that is engaged in payment card financial services on our campus, must also comply with the PCI DSS.
As a Stanford merchant, you are required to do the following on an annual basis. Compliance is not a one-time requirement that you can complete and forget, so besides the annual requirement, please note you, as a Stanford Merchant must adhere to the PCI DSS requirements and policies on a daily basis. Please see below Compliance Dos & Don'ts, which highlight some of the ways to stay compliant. The University IT Information Security Office (ISO) collaborates with Merchant Services to help Stanford department merchants meet their PCI Compliance requirements.
The timeline below outlines the tasks that must be completed by merchants, and the university as a whole, in order to satisfy the annual PCI DSS Certification:
Date/Deadline | Task |
---|---|
May to Mid-June | All merchants complete their annual PCI training. |
1st week of September | MS sends an initial announcement email to all merchants. |
September to October | MS sends reminder emails to merchants for their SAQ completions. |
1st week of November | All merchants complete their MID level SAQs in the CampusGuard portal. MS sends warning emails to merchants who missed the deadline. |
November | MS sends warning emails to merchants who missed the deadline. |
1st week of December, MS sends reminder emails to merchants for their SAQ completions. | Stanford submits overall Attestation of Compliance (AOC) to acquiring bank and American Express. |
Adhering to the PCI DSS requirements provides critical protective measures to ensure that payment card data is kept safe throughout every transaction.
PCI DSS has 12 broad requirements and more than 300 sub-requirements. The Council created these requirements to meet six primary control objectives:
Goals | PCI DSS Requirements |
---|---|
Build and Maintain a Secure Network |
|
Protect Cardholder Data |
|
Maintain a Vulnerability Management Program |
|
Implement Strong Access Control Measures |
|
Regularly Monitor and Test Networks |
|
Maintain an Information Security Policy |
|
Source: PCI DSS Quick Reference Guide: Understanding the Payment Card Industry Data Security Standard version 3.2.1
Each merchant must assign a PCI contact person to monitor, document, and manage card acceptance processes and security. There are a few key things you as a merchant should do and not do to ensure you are compliant with PCI’s standards. This shortlist of “Do’s” and “Don'ts” should get you started down the path of PCI compliance.
PCI Compliance: DO’s | PCI Compliance: DON’Ts |
---|---|
|
|
The SAQ is a validation tool that is primarily used by merchants to demonstrate ongoing compliance with the PCI-DSS to the university’s acquiring bank: WFMS and American Express. The SAQ includes a series of yes-or-no questions for each applicable PCI DSS requirement. There are eight different types of SAQs depending on merchants’ payment processing methods. If you are not sure which SAQ would apply or have any questions when filling out the SAQ, please consult with Merchant Services or PCI compliance for further assistance.
SAQ | Description | # of Questions |
---|---|---|
A |
E-Commerce channels/MOTO (fully outsourced) - (no electronic cardholder data storage)
|
22 |
A-EP |
E-Commerce channels (direct post) - (no electronic cardholder data storage)
*Consult with the PCI compliance team if you think you qualify for SAQ A-EP. |
191 |
B |
Processes cards via: (no electronic cardholder data storage)
Not applicable to e-commerce channels. |
41 |
B-IP |
Processes cards via: (no electronic cardholder data storage)
Not applicable to e-commerce channels. |
82 |
C |
Payment application systems connected to the Internet: (no electronic cardholder data storage)
|
160 |
C-VT |
Processes cards: (no electronic cardholder data storage)
Not applicable to e-commerce channels. |
79 |
P2PE-HW |
Point-to-Point Encryption: (Hardware terminals only)
Not applicable to e-commerce channels. |
33 |
D |
*Consult with the PCI compliance team if you think you qualify for SAQ D. |
329 |