19473_Authority_Oct-opt

y our g uide to Pci c omPliance By Jennifer Mariani, CEO of CourseVector I t is almost an expectation in our cashless society for merchants and vendors to accept payments online. Authorities are no exception. Accepting online payments is a fast and easy way to get paid, but it comes with its own set of rules and regulations. The Payment Card Industry Data Security Standard (PCI DSS) was developed in late 2004 by the major credit card brands with the development of the PCI Security Standards Council (PCI SSC) following two years later. In short, PCI DSS is a common rulebook for protecting card payment data. It applies the same core security expectations to every organization that touches that data, so customers can trust their card info is handled safely wherever they are paying. What does this mean for your authority? PCI DSS applies to any organization that stores, processes, transmits, or could otherwise affect the security of payment card information. This includes not only organizations that directly accept credit card payments, but also those that use third-party vendors to process payments on their behalf. Municipalities and authorities may accept payments through several methods, including: • On the website: Payment is made directly on the website using an embedded payment form or portal. The user does not leave your website to make a payment. • Via invoice: Payment is made using an invoice with a “pay now” link. QuickBooks is a good example of a program that might send an invoice with a link for users to pay right from the invoice. • Link to payment processor: Payment is made by redirecting users away from the authority’s site to the payment processor’s site. PayPal is a popular example of a payment processor to which a site can link to accept payment. The method used to collect payments affects the organization's PCI DSS responsibilities and the scope of its compliance requirements. In general, organizations that handle payment card data directly have greater compliance obligations than those that redirect users to a PCI-compliant third-party payment processor. PCI compliance must be documented through approved validation methods. Depending on transaction volume, payment processing method, and payment brand requirements, an organization may be required to complete a formal PCI DSS assessment and submit a Report on Compliance (ROC) or may qualify to complete a Self- Assessment Questionnaire (SAQ). These documents serve as the official record of an organization's PCI DSS compliance status for payment processors, acquiring banks, and payment card brands. So what are they looking for? When an Approved Scanning Vendor (ASV) scans your site, they are