Maestro Global Rules (PDF) - MasterCard

Security
8.9 Account Data Compromise Events
3. Registration of any TPP(s) or DSE(s) associated with the ADC Event under
the MasterCard Registration Program (MRP), in accordance with Rule 8.10.6
of this manual.
4. Notification of an ADC Event or Potential ADC Event to and in cooperation
with the Corporation and, as appropriate, law enforcement authorities.
5. Verification that the forensics investigation was initiated within seventy-two
(72) hours of the ADC Event or Potential ADC Event and completed as
soon as practical.
6. Timely receipt by the Corporation of the unedited (by other than the
forensic examiner) forensics examination findings.
7. Evidence that the ADC Event or Potential ADC Event was not foreseeable or
preventable by commercially reasonable means and that, on a continuing
basis, best security practices were applied.
In connection with its evaluation of the Customer’s or its Agent’s actions, the
Corporation will consider, and may draw adverse inferences from, evidence
that a Customer or its Agent(s) deleted or altered data.
As soon as practicable, the Corporation will contact the Customer’s Security
Contact, Principal Contact and Merchant Acquirer Contact as they are listed in
the Member Information—Cirrus/Maestro tool on MasterCard Connect, notifying
all impacted parties of the impending financial obligation.
It is the sole responsibility of each Customer, not the Corporation, to include
current and complete information in the Member Information—Cirrus/Maestro
tool on MasterCard Connect.
NOTE
An addition to this Rule appears in Chapter 17, “Europe Region,” of this rulebook.
8.9.4.3 Investigation and Other Costs
The Corporation may assess the responsible Customer for all investigation and
other costs incurred by the Corporation in connection with an ADC Event and
may assess a Customer for all investigative and other costs incurred by the
Corporation in connection with a Potential ADC Event.
8.9.5 Assessments for Noncompliance
If the Customer fails to comply with the procedures set forth in this Rule 8.9,
the Corporation may impose an assessment of up to USD 25,000 per day for
each day that the Customer is noncompliant.
When an Issuer becomes aware that Account data has been lost, stolen,
misplaced, or the like, by any person (for example, a tape of Account data is
lost during transit to a storage site), the Issuer must report the occurrence as
described above. The Corporation will determine in its sole discretion whether
it considers such act to be an Account data compromise event.
©1993–2012 MasterCard. Proprietary. All rights reserved.
8-16 9 November 2012 • Maestro Global Rules