Re: PCI DSS University-Wide Compliance

["Lorenz, Eva" <evalorenz () UNC EDU>]

We have independent questionnaires from all merchants that roll up into university-wide questionnaires (only these end 
up being accessible to outside parties). We have split up merchants based on payment gateway and means of accepting 
credit cards (POS versus SAQ-D).

Ideally, we try to meet with each merchant individually, but staff resources are an issue. I have 30% time allocated to 
compliance in general (not just PCIDSS) and when I was tossed into PCI compliance, I took me a couple of months just to 
meet individually with SAQ-D merchants and analyze what we had on campus. Needless to say that cannot be repeated each 
year without sacrificing other projects.

I think SAQ-A and SAQ-B can be summarized easier than SAQ-D because our SAQ-D merchants have a multitude of software 
solutions, payment gateways etc. So I hope to get additional staff to work with these merchants and do annual visits re 
compliance. I would not want to assess SAQ-D compliance without looking at each individual questionnaire from merchants 
and reserve time to call and discuss issues. We simply have too much variety of simply answer a university 
questionnaire without relying on individual questionnaires. One battle I am fighting is the desire that I provide 
answers to specific sections and I have been resistant to do that because I don't want any changes to slide through 
because specific sections got pre-filled answers.

For SAQ-B we require analog lines and for SAQ-A we do check on staff regarding whether any credit cards were handled in 
person. This creates some uniformity, especially regarding risk.



From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Carlos 
Lobato
Sent: Wednesday, January 30, 2013 1:12 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] PCI DSS University-Wide Compliance


Hello All,



For those PCI DSS Compliance Gurus, how do you assure University-Wide PCI DSS compliance?



  1.  Do you ensure PCI DSS compliance for each merchant ID individually or do you take all merchant IDs for the 
University?
  2.  If individually, do you ONLY consider those transactions for compliance purposes?
  3.  How do you ensure/assure compliance for your University as a whole?

I would really appreciate any feedback I can get from experts as Audit Committees have a tendency to ask basic 
compliance questions and request global assurance.



I would also appreciate approches used at your University to address global compliance assurance or other general 
opinions, comments, etc.



Carlos



Carlos S. Lobato, CISA, CIA

IT Compliance Officer



New Mexico State University

Information and Communication Technologies

MSC 3AT PO Box 30001

Las Cruces, NM  88003



Phone (575) 646-5902

Fax (575) 646-5278