MIT MERCHANT POLICIES AND PROCEDURES

Revision History

Changes	Approving Manager	Date
Business Policy	December 2009
Revised Edition	December 2012
Revised Edition to include Type C	June 2013
Revised Edition to include Type C-VT	September 2012
Revised Edition to include PCI DSS 3.0	November 2014

Table of Contents

MIT Credit Card Merchant Handbook	4

PCI Executive Committee	4

New Merchant Requests	4

Before You Request a Merchant Account:	4

Determining the Appropriate Credit Card Solution	5

POS (Point of Sale) Terminals	5

Third-party Service Providers	6

Requesting a Credit Card Merchant Account	6

Merchant Responsibilities	6

Merchant Account Agreement	6

Fraud Services	6

Off-hours and Weekend Support	7

Compliance	7

Merchant Responsibility for TrustKeeper Portal	7

Merchant Responsibilities for Annual Re-Certification	8

Audits	8

Merchant Responsibilities for Ongoing Operations (Four Forms)	9

Merchant Responsibilities for Monitoring and Security Incident Handling	9

Reconciliation Procedures	10

Electronic Media Access	10

Hardcopy Media	10

General Retention Requirements	11

Disposal Process	11

Destruction	11

Chargebacks	11

Background Checks	12

Local Policies and Procedures	12

Credit Card Expenses	12

Credit Card Acceptance Resources	12

Appendix A: Merchant Activities	13

Appendix B: New Merchant Business Plan	14

Appendix C: MIT Business Owner Acknowledgement	20

Appendix D: PCI and CISP Overview	21

Appendix E: Merchant Audit Checklist guideline	22

MIT Credit Card Merchant Handbook

MIT staff or students that wish to accept credit cards must read, understand, sign and comply with MIT Policy and Payment Card Industry Standards. MIT takes protecting customer data very seriously. It is MIT’s policy not to store any customer credit card information electronically on campus or process any credit card data on any web or application servers. MIT offers secure methods for acceptance of credit cards as outlined in this handbook. It is against MIT policy for anyone to use any other methods for processing credit cards unless approved in advance and in writing by MIT’s PCI Compliance Officer.

Merchants must review this document and understand the commitment of resources they require before requesting a credit card Merchant account, sign the Employee Acknowledgement Form and be responsible for the annual renewal process.

Payment Card Industry (PCI) Executive Committee

The PCI Executive Committee is responsible for overseeing MIT’s PCI Compliance Program. The committee:

Evaluates PCI policy standards and assesses impact to MIT

Reviews annual report of merchant operations and PCI status

This committee has representatives from the Office of the Vice President of Finance, MIT’s Information Services and Technology group, MIT’s Audit Division, and MIT’s Office of Risk Management.

New Merchant Requests

Before You Request a Merchant Account:

Credit Card Association rules govern security and risks associated with accepting credit cards, Requesters should process a full understanding of the responsibilities and alternatives of being a merchant.

One Time or Infrequent Events Option

If you interested a credit card solution for one-time or infrequent events, please contact conferences@mit.edu.

Determining the Appropriate Credit Card Solution

The merchant type is determined by the payment solution. MIT has six approved methods of accepting payments. This policy handbook is for Type A, A-EP, B, C-VT and C.

.

Five Approved MIT Credit Card Solutions (listed by Type A, A-EP, B, C-VT, and C):

Card-not-present merchants (e-commerce or mail/telephone order) – Type A that have fully outsourced all cardholder data functions to PCI DSS compliant third-party service providers, with no electronic storage, processing, or transmission of any cardholder data on the merchant’s systems or premises..

Partially Outsourced E-commerce Merchants Using a Third-Party Website for Payment Processing – Type A-EP – This applies to e-commerce merchants with a website(s) that does not itself receive cardholder data but which does affect the security of the payment transaction and/or the integrity of the page that accepts the consumer’s cardholder data. SAQ A-EP merchants are e-commerce merchants who partially outsource their e-commerce payment channel to PCI DSS validated third parties and do not electronically store, process, or transmit any cardholder data on their systems or premises.

POS with analogue line (Face to Face/Phone) – Type B – Merchants who process cardholder data only via imprint machines or standalone, dial-out terminals and do not store cardholder data on any computer system.

Isolated Virtual Terminals on Computers – Type C-VT A virtual terminal is a web-browser based access to an acquirer, processor, or third-party service provider website to authorize payment card transactions, where the merchant manually enters payment card via a securely connect web browser. This merchant does not use a card reader.

Payment Applications System Connected to the Internet No Electronic Cardholder Data Storage -Type C – Merchants process cardholder data via POS machines or other payment application systems connected to the Internet, do not store cardholder data on any computer system, and may be either brick-and-mortar (card present) or e-commerce or mail/telephone-order (card-not present).

Third-party Solutions Must:

Be a PCI and PA-DSS (Payment Application Data Security Standard) compliant solution.

Process the payment through MIT's contracted payment provider, Cybersource, and that the bank is GPN (Global Payment Network).

Produce a PCI Compliance Certificate annually.

POS (Point of Sale) Terminals

Point of Sale Terminals are ordered by MIT Merchant Services and shipped directly to the merchant address on record.

Merchants are responsible for contacting Global Access Solutions for POS Terminal support.

Merchants must contact IS&T as they will need to have an analogue line installed.

Third-party Service Providers

A service provider is any third party that stores, transmits or processes credit card numbers on behalf of a merchant. If you plan on using a service provider, you must have approval from the PCI Executive Committee in writing before you sign a contract.

Service providers must be contractually obligated to implement and maintain policies and procedures to manage their systems and processes which cardholder data is shared or could affect the security of cardholder data. They must be in compliance with PCI requirements at all times. Contract help may be provided by VPF Procurement.

Merchants must obtain a PCI Compliance Certificate from the Third-party Service Provider at least annually.

Not permitted by MIT for Credit Cards: No Exceptions

NO software & website hosting

NO purchasing of POS devices or systems

NO storing, processing or transmitting any credit card data on any MIT web server or application servers.

Requesting a Credit Card Merchant Account

Merchant requests must be emailed to chargemit-help@mit.edu. The email request should include the type of merchant solution and the completed Business Plan Application located in Appendix B and online on the Merchant Services website (https://web.mit.edu/chargemit/secure/becoming/business-plan-app.doc).

Note: Student Group applications must be reviewed and approved by Student Activities Finance office.

Type B Merchant Request Emails Must Also Include:

Indicate the quantity of POS devices you will need

Type B (POS with analogue line): If your office or location is not equipped with and analogue line you must contact IS&T and request installation of the analog line.

IS&T website: http://web.mit.edu/ist/start/telecommunications/index.html

Merchant Responsibilities

Merchant Account Agreement

Merchants must comply with and sign a merchant account agreement when requesting a merchant account. The sign-off form is located on the Merchant Services website https://web.mit.edu/chargemit/secure/becoming/

A copy of the business owner acknowledgement form is included as Appendix C. This agreement will need to be renewed annually.

Fraud Services

Cybersource, Inc. has Address Verification (AVS) and Card Number Verification (CVV/CVC) activated for web fraud prevention services as a default setting. To monitor and settle any failed CVV transactions see details on Soft Declines - https://web.mit.edu/chargemit/secure/existing/softdeclines.html

Off-hours and Weekend Support

If you are holding an event on the weekend or off hours, please send an email to chargemit-help@mit.edu so the Merchant Services team is aware.

Cybersource weekend coverage (production down issues only): 1-888-417-2230

MIT’s weekend server operations support (not business or application support)

Send an email to ops-help@mit.edu if your issue is not urgent.

If your request is urgent or your email was sent a while ago and you now wish to escalate, call 617-324-2778. If you do not get a response within one hour, call 617-324-9080 and leave a voice mail with the time of your fist call.

Compliance

All MIT merchants must be certified annually to be in compliance with PCI Data Security Standards (PCI DSS) in order to accept credit cards and will receive a compliance certificate once they have completed and passed the following requirements and maintain a compliant state 24/7.

Compliance Requirements Include:

The completion of an annual questionnaire provided online by Trustwave a certified vendor of MasterCard and Visa.

Monthly network vulnerability scans performed by Trustwave, a certified vendor of MC/Visa, on all external facing IP addresses on the same subnet as the computer/workstation dealing with credit cards. This requirement is for all merchants using MIT equipment/computers to process over IP. (This is not applicable to Type A or B merchants).

Quarterly internal penetration testing will be performed by MIT IS&T staff.

For more information on the PCI standards and these requirements please visit these two websites:

http://usa.visa.com/merchants/risk_management/cisp_merchants.html

https://www.pcisecuritystandards.org/pdfs/pci_audit_procedures_v1-1.pdf

New merchants must achieve certification before they can begin accepting credit cards. MIT Merchant Services will deactivate any merchant account at the bank if the Merchant does not reach or maintain PCI certification. Any merchant who fails the PCI questionnaire, PCI Audit, or monthly scans will have 30 days to correct all vulnerabilities identified. If not corrected within 30 days, VPF will deactivate the merchant. MIT Merchant Services will notify the business owner and all users of the account of any failures and actions taken.

MIT has contracted with Trustwave to provide the certification testing. MIT Merchant Services will ensure that each new merchant logs into the TrustKeeper portal and successfully completes the questionnaire and schedules scanning in the network questionnaire for their IP address (es) if applicable.

Merchant Responsibility for TrustKeeper Portal

Merchants must complete the TrustKeeper registration process within three business days of receiving a welcome email from TrustKeeper.

After completing the registration process and creating their login ID, merchants can log into the portal at https://login.trustwave.com/portal-core/home/plm/reset=2e1fa6e3-1281-41af-b37b-376df511e54c

If your website is hosted by a third party you are responsible for ensuring the host is contractually obligated to be compliant with PCI requirements and to have their systems scanned by an authorized assessor on a quarterly basis.

Merchants must complete a self-assessment questionnaire.

If technical contacts will be required, ensure they have their own login ID to the portal account as well.

For help using the TrustKeeper portal, see the online help, email support@trustkeeper.net or call 800-363-1621.

Merchants will not be allowed to continue processing credit cards in a non-compliant status past the 30 days. Merchants may be allowed a temporary suspension without deactivating your account in the following conditions:

The merchant has deactivated/ taken their web site/page off line.

Merchant has diligently and continuously worked on the resolution(s)

The Merchant Services team has notified you of approval.

If a merchant account is deactivated the Merchant will need to reapply for a new merchant account after they become compliant and will incur any charges associated with the opening of the account. The opening of a new merchant number with the bank may take up to 30 business days, longer if using a third party solution.

Merchant Responsibilities for Annual Re-Certification

All Merchants must re-certify annually. Merchants must logon to the TrustKeeper portal and complete the questionnaire within 30 days of expiration.

Audits

Merchants are subject to periodic audits of their operations by MIT Merchant Services and the Audit Division. These audits may include a contract with a third party to perform them, if MIT Merchant Services feels it is necessary to have an independent audit. Merchants will receive a copy of the audit report, and any deficiencies must be corrected within 30 days. If you are audited, please review the checklist in Appendix E.

Frequencies of audits are defined based on the following criteria:

Annually

Merchants are subject to annual audits and will be notified within two weeks to schedule resources for the audit.

Every 5 years

Merchants that use a third-party provider that accepts credit card payments via a web page or application connected with Citrix or to the hosting provider.

Merchants using terminals (POS with analogue lines).

The audits will follow the following process:

The merchant will be notified of the audit.

MIT Merchant Services or the Audit Division will conduct the audit. (Note that the audit may be part of a larger audit of the merchant’s organization or only a credit card audit.)

MIT Merchant Services or the Audit Division will issue an audit report to the merchant noting any issues identified.

MIT Merchant Services or the Audit Division will issue a letter to chargemit-help@mit.edu indicating any PCI compliance issues identified. If no issues are identified, the letter will indicate that the merchant is compliant. Note that only PCI issues will be included in the letter. Other issues identified during the audit are only reported to the merchant and their management.

It should be noted that periodic audits do not make MIT exempt from the risk or exposure in the event of a breach. It would however, exempt MIT from fines levied solely for being out of compliance.

Merchant Responsibilities for Ongoing Operations (Five Forms)

Four forms required for ongoing operations:

MIT SAQ A

MIT SAQ A-EP

MIT SAQ B

MIT SAQ C-VT

MIT SAQ C

MIT PCI Security Policy

Merchant Responsibilities for Monitoring and Security Incident Handling

This section deals with electronic as well as paper based records. For breaches of paper records, the steps that refer to electronic issues can be omitted.

Be alert to potential breaches and regularly monitor system logs for:

Suspicious behavior

Unusual incidents in audit logs

User or anonymous report of problems

Unauthorized security configuration changes

Unusual traffic or activity

Lapsed physical security

Sensitive information in the wrong place or hands

User complaint which triggers an investigation

Loss or theft of a computer or backup media

Contain and limit the exposure immediately:

Log all actions taken

Do not access or alter compromised systems.

Do not turn the compromised machine off. Instead isolate compromised machines from the network (i.e., unplug network cable).

Preserve all available logs (firewall, IDS, web server, operating system, remote access, etc.) that could be used to help identify the source and extent of the attack.

If using wireless network, change SSID on the AP and other machines that may be using this connection with the exception of any systems believed to be compromised.

Be on high alert and monitor other systems that accept, store or process credit card account numbers as well as any other computers that users on the breached computer have accounts (too often the same password is used).

Contact infoprotect@mit.edu, chargemit-help@mit.edu, and the MIT Data Incident Response Team (dirt@mit.edu) immediately indicating that a breach or suspected breach has occurred or is in progress.

Identify what account numbers or other personal information may have been compromised.

Work with MIT Data Incident Response Team and the Office of General Counsel to determine if notification should be sent to individuals affected by the incident.

Compromised systems must not be put back into production or connected to the Internet until the MIT Data Incident Response Team gives its consent.

If notifications are to be sent, work with the Office of General Counsel on the notification. Note: Any cost of sending notifications is the responsibility of the Merchant.

The Merchant must assume any extra costs associated with the incident, including:

Any external resources contracted to participate in the investigation

Cost of level 1 PCI Security Standard Assessment performed by external third party. (See PCI Information Security Policies and Procedures document for Scope of this external assessment)

Any fines or penalties assessed by the bank or credit card associations

Any legal fees or penalties incurred as a result of the incident

Reconciliation Procedures

The merchant is responsible for all reconciliations of their cash/revenue and fees to ensure they are settled and posted to the GL account and cost objects. This reconciliation must be done monthly and is subject to audit review to ensure the reconciliation was completed (bank statement, GL, dated, and signature of the person reconciling). See Appendix A for a detailed list of responsibilities.

Electronic Media Access

Electronic media containing confidential or sensitive information (e.g., CD, DVD, floppy disk, hard disk, tape, etc.) is subject to the following storage guidelines:

At no time should electronic media containing confidential or sensitive cardholder data be removed from any MIT secure office environment with the exception of computer system backups.

Electronic media containing cardholder confidential or sensitive data is to be physically retained, stored or archived only within secure MIT office environments, and only for the minimum time deemed necessary for their use.

All electronic media containing confidential or sensitive information should be clearly labeled as such.

All removable, confidential or sensitive electronic media must be stored in a secure location.

All media must be sent or delivered by a secured courier or other delivery methods that can be accurately tracked.

No credit card data should be stored in Excel or email.

Hardcopy Media

Hard copy materials containing confidential or sensitive information (e.g. paper receipts, paper reports, faxes, etc.) are subject to the following storage guidelines:

At no time are printed reports containing confidential or sensitive information to be removed from any MIT secure office environment.

Printed reports containing consumer confidential or sensitive data are to be physically retained, stored, or archived only within secure MIT office environments, and only for the minimum time deemed necessary for their use. Access to these records must be restricted to those who need it to perform job functions.

All hardcopy material containing confidential or sensitive information should be clearly labeled as such.

All confidential or sensitive hardcopy media must be stored in a secure and locked container (e.g. locker, cabinet, desk, storage bin).

Confidential or sensitive hardcopy material is never to be stored in an unlocked or insecure containers or open workspaces.

General Retention Requirements

All confidential and sensitive data, regardless of storage location, will be retained only as long as required for legal, regulatory and business requirements. Specific retention lengths will be established by the data creator.

As a special case, cardholder data used for a single transaction may be kept for up to 120 days. This applies for cardholder data retained in any kind of format including digital and paper.

Cardholder data utilized for recurring transactions will be retained by our third party outsourcing agent. MIT will not retain cardholder data in electronic form on MIT information processing systems.

All system audit logs related to PCI Compliance must be retained for one year with 90 days available for online viewing.

Never store any data related to credit card transactions that is not required for reconciliation, chargeback research and reporting and then never for a period longer than 60 days. The processing vendor and credit card operations should be the source for reporting data rather than local copies which increase our risk and exposure.

Disposal Process

A programmatic process will be executed on cardholder information systems nightly to remove all confidential or sensitive data that exceeds business retention requirements.

Other applicable data stored in files and directories where the containing media will be reused must be deleted securely by a “wiping” utility.

Media containing confidential or sensitive cardholder data that should no longer be retained must be disposed of in a secure and safe manner.

Destruction

Truncate all but the last four digits of the credit card number when displaying or storing cardholder data until it can be disposed of properly. Masking should be accomplished by a Black Magic Marker cross through and squiggle lines through the cross through. Blacked out data alone, the document can be scanned and reproduced.

In the case of receiving a hard copy version of a credit card, all hardcopies must be shredded by a cross-cut shredder prior to disposal and if a merchant chooses to use a third-party contract for shredding, they must receive a certificate from the third-party each time used that indicates their data will in fact be shredded and that they are in compliance with the Commonwealth of Massachusetts law 93I.

Chargebacks

Chargebacks occur when a cardholder disputes a charge on their credit card statement. Customers may dispute because they believe that they did not receive the goods or services for which they were charged or if they did not authorize the charge. Merchants are notified by the acquiring bank of the disputed charge. Merchants must follow the instructions on the form they receive from the bank and reply by the date specified. Merchants must respond to the chargeback in the timeframe allotted by the bank or the Merchant will be charged directly and the customer automatically refunded.

Background Checks

Background checks are not performed at MIT, as merchants processing credit cards do not have access to cardholder data and only have access to one credit card number at a time. MIT uses a third-party hosting solution to store and process all credit card data.

Local Policies and Procedures

Merchants must inform all personnel that will be handling credit cards of this agreement and ensure they are aware of the MIT security site. They can have local policies and procedures for handling credit cards and include who is responsible for functions and duties (including), reconciliations, chargebacks, record retention, data access, and breach reporting. In addition, there may be local processes involved with the credit card processing that are not included in these general procedures (e.g., managing your point of sale system). These policies must be documented locally.

Employees who are involved in credit card processing must receive copies of local policies and be made aware of the MIT Merchant Services website. Business owners must annually sign an acknowledgement that they have read and understand the policies and will comply with them. The acknowledgement form is included as Appendix C.

Credit Card Expenses

The Merchant will be responsible for all initial and ongoing costs related to credit cards. Refer to the MIT Merchant website for detailed costs: https://web.mit.edu/chargemit/secure/overview/costs.html

Credit Card Acceptance Resources

MIT Merchant Credit Card site: http://vpf.mit.edu/merchant_services

Information on Payment Card Industry Data Security Standards:

https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml

Massachusetts Law 201 CMR 17.00: STANDARDS FOR THE PROTECTION OF PERSONAL INFORMATION OF RESIDENTS OF THE COMMONWEALTH

http://www.sec.state.ma.us/sct/sctpdf/Standards_for_the_Protection_of%20_Personal_Information_of_Residents_of_the_Commonwealth.pdf

MIT Information and General Security web site: http://web.mit.edu/infoprotect/

Merchant Defined Data Fields

Merchant defined data fields are not intended to and must not be used to capture personally identifying information. Accordingly, merchants are prohibited from capturing, obtaining, and/or transmitting any personally identifying information in or via the Merchant-Defined Data fields. Personally identifying information includes, but is not limited to, name, address, credit card number, social security number, driver’s license number, state-issued identification number, passport number, and card verification numbers (CVV, CVC2, CVV2, CID, CVN). In the event Cybersource discovers that merchants are capturing and/or transmitting personally identifying information via the Merchant-Defined Data fields, whether or not intentionally, Cybersource will immediately suspend the merchant’s account, which will result in a rejection of any and all transaction requests submitted by the merchant after the point of suspension.

Appendix A: Merchant Activities

Many activities are involved in processing credit cards. Here's a list of activities that have to be done daily, monthly, and annually.

Daily activities

All merchants are responsible for ensuring that credit cards are processed accurately each day. To ensure that this occurs, as part of the daily activities, merchants should:

Manage soft declines – for detailed instructions see https://web.mit.edu/chargemit/secure/existing/softdeclines.html

Settle and reconcile your batches daily. Ensure that the total amount settled and submitted balances with the credit card records of the transactions.

If processing authorizations for goods or services to be shipped or provided, ensure that these transactions are settled on a timely/daily basis.

Account Reconciliation: Reconcile the amount processed with the amount funded to your checking account (reconcile your EBC to your Bank statement or online GAA processor to your DTR)

Chargeback Investigation and Resolution: Identify and resolve chargeback’s on a timely basis.

Monthly activities

Reconcile your monthly bank statement to your DTR.

Supply the VPF with the required tax reporting if taxes are applicable to your merchant.

Review credit activity and ensure that there is appropriate approval and that credits are valid and not being done by an individual for personal gains.

Historical trend analysis: Measure financial and operation performance to ensure that the credit card activity is meeting expectations.

Review history for any suspicious activity.

Annual activities

Complete the annual renewal process.

Complete the PCI Self Assessment Questionnaire

Complete the Business Owners Acknowledgment form and submit it to MIT merchant services

Provide updated PCI DSS certifications for any third-party provider being used in association with credit card processing

6.

F

8.

11.

Appendix C: MIT Business Owner Acknowledgement

Date: _______________

Thank you for requesting or renewing your Merchant account. As part of the request process and ongoing renewal process (annually), we are requiring each Merchant account “business owner” to sign-off on the PCI compliance guidelines that include business process requirements/responsibilities. (Note: These are in addition to the approved technical solution and non storage of data). These include the following bulleted items that the Merchant is required to comply with:

The Merchant agrees to the following:

Logon and Register with Trustkeeper, https://www.trustkeeper.net/esp/Login.public, within 3 business days of approval of account and complete the appropriate questionnaire.

If you are type D merchant your computers used for processing credit cards transactions will be scanned monthly – you must monitor Trustkeeper to review the results monthly; you will receive these results within 1 day of the scan. Any issues found must be resolved; timing and disposition will depend on severity of findings.

Read, understand and comply with all responsibilities in the MIT Merchant Policies and Procedures (for Type D also the MIT PCI Information Security Policies and Procedures).

Follow all MIT Policies and Procedures located on the Merchant Services website https://web.mit.edu/chargemit/secure/policies/credit.html

Testing – The merchant agrees to fully test their system prior to signing off to move to production. Testing guidelines are located on the website https://web.mit.edu/chargemit/secure/existing/testing.html

Maintain and review security of all users on the account and their access (i.e. all roles order entry vs. manager who can perform credits. All requests for user maintenance must be received via email to chargemit-help@mit.edu with name, email and role of the user (descriptions of users can be found on website https://web.mit.edu/chargemit/secure/existing/

Maintain a secure environment for all credit card information including:

Non storage of credit card data via any electronic method, including email, computer, servers, excel etc…

Destroying or masking of credit card paper data if received

No personal use of any machine in Merchant Services container

No personal equipment or media should be connected to machines in Merchant Services container this includes personal USB memory sticks, CDs or any other form of device or media.

Perform all reconciliations in a timely manner (minimum monthly) to reconcile all accounts (for details of Operational responsibilities see https://web.mit.edu/chargemit/secure/existing/activities.html or Appendix A of the MIT Merchant Handbook.

I am requesting or renewing a Credit Card Merchant Account and I have read and understand the MIT Merchant Policy and Agreement.

My (electronic signature or email of this document) acknowledges that I agree to the MIT Merchant policies and PCI compliance requirements and agree to follow them.
Signature______________________	Department _____________________________

Title__________________________	Merchant Name__________________________

If signing for more than one merchant account, please list all merchant names or use separate forms for each merchant account.

Appendix D: PCI and CISP Overview

Source 9/08 : http://usa.visa.com/merchants/risk_management/cisp_overview.html

“When customers offer their bankcard at the point of sale, over the Internet, on the phone, or through the mail, they want assurance that their account information is safe. That’s why Visa USA has instituted the Cardholder Information Security Program (CISP). Mandated since June 2001, CISP is intended to protect Visa cardholder data–wherever it resides–ensuring that members, merchants, and service providers maintain the highest information security standard.

In 2004, the CISP requirements were incorporated into an industry standard known as Payment Card Industry (PCI) Data Security Standard resulting from a cooperative effort between Visa and MasterCard to create common industry security requirements. Visa USA maintains CISP as the managing program for data security compliance endorsing the PCI Data Security Standard.

Effective September 7, 2006, the PCI Security Standards Council ("PCI SSC") owns, maintains and distributes the PCI Data Security Standard (DSS) and all its supporting documents. Visa USA, however, continues to manage all CISP compliance enforcement and validation initiatives. In addition, the former QDSC Program has also transitioned to the PCI SSC. Please refer to the Assessors page for more information.

If you are a non-U.S.-based entity, please visit Visa International Account Information Security (AIS). “

Appendix E: Merchant Audit Checklist guideline

MIT CREDIT CARD MERCHANT

PCI and Accounting Compliance Review Checklist

Merchant Checklist (subject to review):

Merchant name ____________________

Merchant type _____________________

Merchant Trustkeeper Company Name _____________________________

Completed
Merchant has signed Merchant Account Agreement
Merchant completion and ownership of Trustkeeper compliance certification.
Security review – user access for Merchants (roles and types)
Merchant reconciliation daily or weekly (monthly minimum) bank reconciliation to GL SAP financials (signature of reviewer available for audit).
Merchant local policy and procedure – covering paper processes and ownership of bank reconciliation, chargebacks, record retention, breach reporting and Trustkeeper.
Provide PCI/PA DSS certifications and any 3rd party vendor if applicable.
Paper credit card data if applicable to merchant – is stored in secure environment and is masked all but the last 4 digits.
Monthly scans if applicable = (type C only)
Accounting - Processing goods or services and settlement timely of transactions (revenue recognition).
Accounting – Credits (supporting documentation and approval for any credits issued).
Accounting – Tax reporting (if applicable to merchants for taxable products or services).