The University of Arizona
Home » Projects & Initiatives

Payment Card Industry Data Security Standard (PCI DSS)

 

All UA credit card merchants must comply with the Payment Card Industry Data Security Standard (PCI DSS) to ensure the security of cardholder data processed via their merchant account. The PCI DSS includes requirements for security management, policies, procedures, network architecture, software design and other protective measures. For information about the PCI DSS, visit the following PCI Security Standards Council web pages:

FSO-Bursar's Department Services governs and enforces PCI DSS compliance. FSO-Bursar's Department Services partners with Information Security to determine appropriate technical compliance strategies and to develop supporting materials to assist units with compliance. For assistance with credit card merchant questions, issues or concerns, please contact FSO-Bursar's Department Services at 621-5781.  Additional information is available on the website.

To determine what your unit must do to comply, review Section 8.14 of the FRS Departmental Manual and follow the suggested approach below.

1. Merchant Classification - Determine your merchant classification based on your payment method.

  • Payment Methods and Validation Requirements Table
  • Options available through FSO-Bursar's Departmental Services - Bank of America and CyberSource
    • Dial pay
    • Point of sale equipment
    • Virtual Terminal - Cybersource-hosted online order form into which the UA merchant enters all orders received by mail, telephone, fax or email, or at the point of sale
    • Hosted Order Page - CyberSource-hosted online order form into which customers enter payment info; linked from the merchant's web site; no shopping cart
    • Silent Order Post - Customized, UA merchant-hosted implementation of the Hosted Order Page, into which customers enter payment info

2. Scoping - Define the scope for compliance with network segmentation.

3.  Gap Analysis - Understand the technical and operational requirements and determine your needs.

4.  Implementation - Implement the requirements to address non-compliant findings.

5. SAQ/QSA Validation - Fill out the Self-Assessment Questionnaire (for self-assessment) or Report on Compliance Template (for onsite assessment by a Qualified Security Assessor). 

6.  Scan Validation - Obtain a vulnerability scan, if required (see step 1).

7.  Stay Compliant - Sustain compliance as rules and systems change.

FAQs

REPORT a payment card security problem. Please reference your department name and related details to ensure proper escalation. 

PCI DSS Principles

Build and Maintain a Secure Network

1. Install and maintain a firewall configuration to protect cardholder data

2. Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data

3. Protect stored cardholder data

4. Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program

5. Use and regularly update anti-virus software

6. Develop and maintain secure systems and applications

Implement Strong Access Control Measures

7. Restrict access to cardholder data by business need-to-know

8. Assign a unique ID to each person with computer access

9. Restrict physical access to cardholder data

Regularly Monitor and Test Networks

10. Track and monitor all access to network resources and cardholder data

11. Regularly test security systems and processes

Maintain an Information Security Policy

12. Maintain a policy that addresses information security

Source: PCI Security Standards Council