PCI Compliance

Santa Rosa Junior College PCI DSS Guideline

Issue Date: 08/21/2014

Reviewed:

All card processing activities and related technologies must comply with the Payment Card Industry Data Security Standard (PCI-DSS) in its entirety.  Card processing activities must be conducted as described herein and in accordance with the standards and procedures listed in the Related Documents section of this Guideline.  No activity may be conducted nor any technology employed that might obstruct compliance with any portion of the PCI-DSS.

This guideline shall be reviewed at least annually and updated as needed to reflect changes to business objectives or the risk environment.

Applicability and Availability

This guideline applies to all employees.

Relevant sections of this guideline apply to Student workers, vendors, contractors, and business partners.  The most current version of this guideline is available at the Business Services office.

Specific Guideline Requirements

Adherence to Standards

Configuration standards must be maintained for applications, network components, critical servers, and wireless access points.  These standards must be consistent with industry-accepted hardening standards as defined, for example, by SysAdmin Assessment Network Security Network (SANS), National Institute of Standards Technology (NIST), and Center for Internet Security (CIS

Configuration standards must include:

  • Updating of anti-virus software and definitions
  • Provision for installation of all relevant new security patches within 30 days of notification.
  • Prohibition of group and shared passwords

Handling of cardholder Data

Distribution, maintenance, and storage of media containing cardholder data, must be controlled, including that distributed to individuals.  Procedures must include periodic media inventories in order to validate the effectiveness of these controls.

Procedures for data retention and disposal must be maintained by each department and must include the following:

  • Legal, regulatory, and business requirements for data retention, including specific requirements for retention of cardholder data
  • Provisions for disposal of data when no longer needed for legal, regulatory, or business reasons, including disposal of cardholder data
  • Coverage for all storage of cardholder data, including database servers, mainframes, transfer directories, and bulk data copy directories used to transfer data between servers and credit card processors.  
  • a programmatic (automatic) process to remove, at least on a quarterly basis, stored cardholder data that exceeds business retention requirements, or, alternatively, an audit process, conducted at least on a quarterly basis, to verify that stored cardholder data does not exceed business retention requirements.
  • Destruction of media when it is no longer needed for business or legal reasons as follows:
  • cross-cut shred, incinerate, or pulp hardcopy materials
  • Purge, degauss, shred, or otherwise destroy electronic media such that data cannot be reconstructed

Credit card numbers must be masked when displaying cardholder data.  Those with a need to see full credit card numbers must request an exception to this guideline using the exception process.

Unencrypted Primary Account Numbers may not be sent via email or fax.

Access to Cardholder Data

Procedures for data control must be maintained by each department and must incorporate the following:

  • Access rights to privileged User IDs are restricted to least privileges necessary to perform job responsibilities
  • Assignment of privileges is based on individual personnel's job classification and function
  • Requirement for an authorization form signed by management that specifies required privileges
  • Implementation of an automated access control system

Critical Employee-facing Technologies

For critical employee-facing technologies, departmental procedures shall require:

  • Explicit management approval to use the devices
  • That all device use is authenticated with username and password or other authentication item (for example, token)
  • A list of all devices and personnel authorized to use the devices
  • labeling of devices with owner, contact information, and purpose
  • Automatic disconnect of modem sessions after a specific period of inactivity
  • Activation of modems used by vendors only when needed by vendors, with immediate deactivation after use

Departmental usage standards shall include:

  • Acceptable uses for the technology
  • Acceptable network locations for the technology
  • A list of College District-approved products
  • Prohibition of the storage of cardholder data onto local hard drives, floppy disks, or other external media when accessing such data remotely via modem (POS)
  • Prohibition of use of cut-and-paste and print functions during remote access

Responsibilities

Will maintain daily operational security procedures consistent with this the PCI-DSS, including administrative and technical procedures for each of the requirements

Chief Security Officer (or Director of IT) is responsible for overseeing all aspects of information security, including but not limited to:

  • creating and distributing security policies and procedures
  • monitoring and analyzing security alerts and distributing information to appropriate information security and business unit management personnel
  • creating and distributing security incident response and escalation procedures that include:
  • Roles, responsibilities, and communication 
  • Coverage and responses for all critical system components
  • Notification, at a minimum, of credit card associations and acquirers
  • Strategy for business continuity post compromise
  • Reference or inclusion of incident response procedures from card associations
  • Analysis of legal requirements for reporting compromises (for example, per California bill 1386)
  • Annual testing of security procedures.
  • Designation of personnel to monitor for intrusion detection, intrusion prevention, and file integrity monitoring alerts on a 24/7 basis
  • plans for periodic training
  • A process for evolving the incident response plan according to lessons learned and in response to industry developments
  • maintaining a formal security awareness program for all employees that provides multiple methods of communicating awareness and educating employees (for example, posters, letters, meetings)
  • review security logs at least daily and follow-up on exceptions

The Information Technology Office shall maintain daily administrative and technical operational security procedures that are consistent with the PCI-DSS (for example, user account maintenance procedures, and log review procedures).

System and Application Administrators shall

  • Monitor and analyze security alerts and information and distribute to appropriate personnel
  • administer user accounts and manage authentication
  • monitor and control all access to data
  • maintain a list of connected entities