The PCI DSS, a set of comprehensive requirements for enhancing payment card data security, was developed in 2004 by the founding payment brands of the PCI Security Standards Council, which included American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa Inc. International. The purpose was to facilitate the broad adoption of consistent data security measures on a global basis.
On October 1, 2008, version 1.2 was released that didn’t change requirements, but enhanced clarity, improved flexibility, and addressed evolving risks and threats. At that time it was recognized that since Universities collect credit card information and process credit card payments, there is a contractual obligation for them to adhere to the PCI DSS, as well as credit card association, rules and regulations.
All officials or administrators with responsibilities for managing University credit card transactions and those employees who are entrusted with processing, transmitting, or handling cardholder information in a physical or electronic format must participate in the PCI DSS Program. In addition, all computers and electronic devices involved in processing payment card data are governed by PCI DSS. By adhering to these standards the University’s liability is limited and the processing of credit cards may continue.
The core of the PCI DSS is a group of principles and accompanying requirements, around which the specific elements of the DSS are organized:
Requirement 1: Install and maintain a firewall configuration to protect cardholder data.
Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters.
Requirement 3: Protect stored cardholder data.
Requirement 4: Encrypt transmission of cardholder data across open, public networks
Requirement 5: Use and regularly update anti-virus software.
Requirement 6: Develop and maintain secure systems and applications.
Requirement 7: Restrict access to cardholder data by business need-to-know.
Requirement 8: Assign a unique ID to each person with computer access.
Requirement 9: Restrict physical access to cardholder data.
Requirement 10: Track and monitor all access to network resources and cardholder data.
Requirement 11: Regularly test security systems and processes.
Requirement 12: Maintain a policy that addresses information security.
CSULA has created a set of campus-specific standards for meeting each of the requirements noted above. In addition to meeting the standards, the campus PCI DSS Program requires:
- Review and approval from the Controller's Officer prior to contracting for any credit card processing equipment, software or services.
- Annual onsite security assessment of all equipment, systems, and networks (and their components) where card member information is processed, stored, or transmitted.
- Quarterly network security scan that remotely tests Internet-connected computer networks and Web servers for potential weaknesses and vulnerabilities.
- An Attestation of Compliance that certifies that the University has accurately completed the annual self-assessment and falls within the applicable processing limits for self-assessment.