Maestro Global Rules (PDF) - MasterCard

Security
8.10 Site Data Protection Program
Acquirer must notify the Corporation’s SDP Department in writing at
sdp@mastercard.com.
At its discretion and from time to time, the Corporation may also request the
following information:
• Merchant principal data
• The name of any TPP or DSE that performs Transaction processing services
for the Merchant’s Transactions
• Whether the Merchant stores Card data
When considering a Merchant that performs Data Storage, Acquirers should
carefully survey each Merchant’s data processing environment. Merchants that
do not store Card information in a database file still may accept payment
card information via a Web page and therefore store Card data temporarily
in memory files. Merchants that do not perform Data Storage never process
the data in any form but may use a DSE for this purpose, such as in the case
of a Merchant that outsources its environment to a Web hosting company,
or an online Merchant that redirects customers to a payment page hosted by
a third party.
8.10.5 Implementation Schedule
All onsite reviews, network security scans, and self-assessments must be
conducted according to the guidelines in Rule 8.10.2 of this rulebook. For
purposes of the SDP Program, Service Providers in this section refer to TPPs
and DSEs.
The Corporation has the right to audit compliance with the SDP Program
requirements. Noncompliance on or after the required implementation date
may result in the following assessments.
Failure of the following to comply
with the SDP Program mandate… May result in an assessment of…
Classification Violations per calendar year
Level 1 and Level 2 Merchants Up to USD 25,000 for the first violation
Up to USD 50,000 for the second violation
Up to USD 100,000 for the third violation
Up to USD 200,00 for the fourth violation
Level 3 Merchants Up to USD 10,000 for the first violation
Up to USD 20,000 for the second violation
Up to USD 40,000 for the third violation
Up to USD 80,00 for the fourth violation
Level 1 and Level 2 Service Providers Up to USD 25,000 for the first violation
Up to USD 50,000 for the second violation
Up to USD 100,000 for the third violation
Up to USD 200,00 for the fourth violation
©1993–2012 MasterCard. Proprietary. All rights reserved.
8-20 9 November 2012 • Maestro Global Rules