Accepting and Handling Payment Card Transactions - University ...

Virginia Polytechnic Institute and State University Policy 3610
Revision: 0 December 14, 2011
Upon hire and at least annually, all employees who are involved with the acceptance, processing or reconciling of
payment card transactions are required to complete Payment Card Training offered by the university and complete
a Payment Card Security Agreement, confirming their understanding and adherence to this policy. University
merchants must maintain records of employees’ training.
8. University merchants must complete an annual assessment (through a method approved by the PCI
Security Standards Council) to validate and document compliance with the payment card requirements.
The University Payment Card Coordinator will coordinate the completion of the annual assessment with
all university merchants.
Annually, university merchants are required to validate compliance with the PCI DSS. This effort will be
coordinated by the University Payment Card Coordinator with the assistance of the Information Technology
Security Office. The Payment Card Coordinator will provide assistance on business processes related to card
operations and the Information Technology Security office will assist with technical security issues.
University merchants are subject to review and audit of compliance with payment card policies on a recurring basis
(by the Bursar Office, internal and external auditors), as well as a review of technical security by the Information
Technology Security Office. Any vulnerability identified via audit or areas of non-compliance with the PCI DSS
must be resolved promptly. The Office of the University Bursar reserves the right to temporarily suspend or
terminate a university merchant’s authorization to accept payment cards for non-compliance.
9. Suspected exposure or theft of payment card information must be reported immediately to the
University Payment Card Coordinator in the Bursar’s Office. University merchants suspecting criminal
activity should immediately contact the Virginia Tech Police Department and the Payment Card
Coordinator.
In the event of an unauthorized disclosure of payment card data, which includes the suspected unauthorized access
of electronic data or paper media, the university merchant should immediately contact the University Payment Card
Coordinator. If criminal activity is suspected the Virginia Tech Police Department should be the first point of
contact. Once an incident has been validated and any potential exposure verified, procedures for contacting
individuals will be determined by university administration, university legal counsel, and outside entities, as
required by contract or law.
4. Exceptions
Written authorization must be obtained from the University Bursar for any university merchant or entity
seeking an exception to any portion of this policy. University merchants seeking exception must submit a
written request identifying the business need and the measures proposed to ensure compliance with the PCI
DSS. It is recommended that university merchants perform a detailed review of business processes and costbenefit
analysis, considering all processing channels that may be of lower risks or costs. Request(s) must at a
minimum include the following:
a. Identification and position description of the employee(s) charged with full PCI DSS
compliance
b. Description of business need for collection or storing of cardholder data
c. Software applications and validation of PCI DSS compliance, including copy of contracts
d. Incident response plans
e. Data Retention and disposal procedures
f. Network diagram(s)
Accepting and Handling Payment Card Transactions Page 6 of 8