E-commerce Policy

Authority

The E-commerce Committee governs and advises on the PCI DSS program at the University, including monitoring and enforcement of this policy. The E-commerce Committee is responsible for annual review of PCI compliance status for the University through completion of quarterly network scans, an annual PCI Self-Assessment Questionnaire (SAQ), and staff PCI compliance training.

Collective oversight of the E-commerce Committee is jointly shared by the Chief Financial Officer & Executive Vice Chancellor for Finance and the Chief Information Officer. The Committee assignment authority and committee chair appointment lies with the Chief Financial Officer & Executive Vice Chancellor for Finance. The responsibilities of the E-commerce Committee and Information Technology are outlined on the E-commerce website: https://ecommerce.ku.edu/.

The University’s Preferred E-commerce Payment Application

The University strongly encourages departments to use the services of the University’s authorized e-commerce payment application, TouchNet U Commerce Central, which is under contract to support and uniformly process e-commerce transactions for the University through a secure gateway and hosted solution. By using TouchNet U Commerce Central, merchants can manage and operate online storefronts, registration sites, and secure payment portals efficiently. To become a merchant using TouchNet U Commerce, departments and campus organizations may complete an Information Request Form at https://ecommerce.ku.edu/.

Payment Card Industry (PCI) Compliance

The University has adopted the standards for compliance requirements and security assessment as outlined in the Payment Card Industry (PCI) Data Security Standards (DSS) as set forth by the PCI Security Standards Council.

These standards can be viewed at the following link for PCI Security Standards Council Document Library for PCI DSS: https://www.pcisecuritystandards.org/document_library

All payment applications, gateways, technology implementation associated with e-commerce or the generation of revenues through the acceptance of credit cards,  debit cards and equipment must be PA-DSS and PCI-DSS compliant.

Individuals designated with responsibility for e-commerce transactions by authorized entities must comply with PCI-DSS. Some of those standards are:

All personal financial and credit card information must be treated as “highly sensitive data” and must be handled as specified under the standards. It is strictly prohibited to retain (or store electronically or manually) the following elements of personal identifiable information (PII):

• Full credit/debit card number;
• Card Validation Code (CVC, CVV2, CVC2);
• Customer’s pin number (PIN); or
• Expiration date or contents of the magnetic strip of a payment card. 
• Cardholder name in combination with any of the above information.

No credit card numbers or information may be transmitted or stored by means of any non-approved software application, personal computer, mobile device, e-mail account, facsimile, multi-functional device, or paper document.

No credit card information is to be requested or obtained through a non-secure environment.  

The storage and retention of partial truncated credit card numbers is to be limited to that which is required for business, legal, and/or regulatory purposes, as documented in the Electronic Data Disposal Policy and KU Records General Retention Schedule.

Due to inherent risks a manual imprinter must not be used to process e-commerce transactions. Inherent risks, include but are not limited to human vulnerability in handling, securing, and protecting data, capturing and storing PII; and other environmental control concerns such as access to data and destruction of carbon imprints and original document.

Failure to comply with the standards can result in serious consequences for the University, including exposure of personal financial information, assessment of substantial fines, possible legal liability, and the potential loss of the ability to accept e-commerce payments. Consequences for individuals processing e-commerce transactions for the University are specified under the Consequences segment of this policy.

Handling of Credit Card, Cardholder, or Other Personal Financial Information

The use of personal financial information as evidenced by check or cardholder data for any purposes other than conducting University business is expressly prohibited. 

Any employee, contractor, or agent who obtains access to personal financial information or cardholder data shall not sell, purchase, provide, or exchange the information in any form to any third party other than to an approved acquiring bank, depository bank, Visa, MasterCard, Discover Card, American Express, or other credit card company, or pursuant to formal governmental request. All requests to provide personal financial information to any other party requires prior authorization by Financial Services. Cash advances on a credit card transaction are strictly prohibited as that type of transaction does not constitute University business.

Initiating New Electronic Check (Check21) Activity

Any department requesting to process physical checks electronically must meet with Financial Services to discuss business purpose, viable process options, anticipated volume and revenue, related costs, and related approvals for such business transactions. https://ecommerce.ku.edu/request-information-or-review

Initiating New Credit Card and/or Electronic Check (eCheck) Activity

Any department requesting to accept credit card payments only and/or credit card payments plus electronic checks (eChecks) must meet with the E-commerce Committee to discuss business purpose, viable process options, anticipated revenue, related costs and related approvals for such business transactions. Once authorized to conduct e-commerce transactions pursuant to this policy, the requesting department is considered and referred to as a merchant and must follow all guidance regarding their merchant role. https://ecommerce.ku.edu/request-information-or-review

Processing Devices

All credit card readers or processing devices requested for purchase must be ordered through Financial Services in accordance with the State of Kansas Credit Card Acceptance contract. The cost of any equipment and supplies will be charged to the merchant.

Any credit card terminals for which the certification by the PCI Security Standards Council has expired or no longer meets industry specifications to support merchant services will be deemed non-compliant. All non-compliant equipment must be discarded or replaced if a continued business use exists. Merchants must arrange for collection and delivery of any non-compliant equipment to the E-commerce Committee for proper disposal. To avoid significant data exposure risk, media sanitization is required. Certificate of media sanitization must be presented to Financial Services after the merchant has promptly surrendered the terminal to KU IT eWaste.

Responsibilities of Merchant

The primary responsibilities of merchant are identified below, however, these may be augmented by additional guidelines or protocols issued by the E-commerce Committee with respect to the specific approvals:

• Allow a minimum of three months for a planning and implementation timeline to accommodate the E-commerce Committee’s review and approval for new or amended credit card and/or echeck payment acceptance arrangements.

• Initiate all inquiries, updates, and conversations to utilize e-commerce processing with the E-commerce Committee using the email address: ecommerce_dl@ku.edu. Acquire approval for all new arrangements and changes to arrangements that involve acceptance of payment cards or electronic checks, including services provided by third parties and/or any manner of connection to the University servers, infrastructure, and networks.

• Review and comply with all University Procurement Services, Financial Services, and Information Technology guidelines when engaging third party service providers of software, systems, equipment or services that include payment card acceptance. Ensure that PCI DSS specific requirements are incorporated into the process and documentation for competitive bids, new contracts or agreements, and renewal of contracts or agreements, and reviewed by the Office of General Counsel prior to execution.

• Access to process payment to a credit card terminal or virtual terminal will be secured and restricted to authorized and trained personnel only. Access must be strictly controlled and tracked by a management-level access person and will be subject to periodic audit. Each new staff with credit card processing related job function, or staff assuming such responsibilities, must complete PCI Compliance training.

• E-commerce transactions processed by merchant on behalf of the University must be for the purpose of conducting University business, such as for payment of fees, tuition, products and/or services of the University. 

• No credit card data, banking data and/or personal financial information may be transmitted or stored by means of any non-approved software application, personal computer, mobile device, e-mail account, facsimile, multi-functional device, or paper document. 

• Credit card payments processed by phone must be fully completed and transmitted while the customer is on the line. Credit card information must not be written down during the call or for later processing.

• Credit card business activity must be submitted through the Miscellaneous Deposit Form processed daily. Reconcile and verify credit card transactions as a part of normal accounting reconciliation process.

• Any merchant specifically contracting for a special payment application and/or equipment is responsible to ensure all requirements of compliance are maintained for PCI, contract specifications, and necessary vendor upgrades to continue and achieve compliance. 

• Accept fiscal responsibility for any costs of acquiring and operating a card acceptance arrangement.

• Notify the Information Technology Security Office of any suspected security incidents, security breaches or data compromise, including suspected loss or theft of data.

• Complete an annual Self-Assessment Questionnaire and E-commerce Merchant Agreement provided by the E-commerce Committee. Ensure all systems, equipment, contracts and business processes are compliant with policy.

• Comply and cooperate with any required internal or external PCI security assessment, audit and/or Internal Audit review.

• Assist the E-commerce Committee on an annual basis in requesting and securing from third party servicer proof of compliance. 

• Inform the E-commerce Committee when the merchant decides it will no longer use operable credit card payment applications or credit card terminals.

• Inform the E-commerce Committee of changes in staff and access roles so that users can be properly managed.

• Accept fiscal responsibility for any expenses and imposed fines associated with independent assessments and remediation of breach and/or non-compliant operations.
• Assume all lost chargeback amounts and associated arbitration costs if chargeback process progresses to pre-arbitration or arbitration stages.

Compliance Requirements for Third Party Service Providers

All-third party service providers that provide processing for e-commerce transactions must have prior approval by Financial Services. Third-party service providers must agree to be contractually obligated to comply with the compliance requirements in this policy and other applicable University policies. Third-party service providers specifically adhere to the following: 

• Provide upon initial contract and at least annually as long as the services contract is in place, enforceable and/or services continue to be rendered, an attestation or certification that:

1. The supplier is PCI DSS compliant as certified by a Qualified Security Assessor (QSA);
2. The supplier software application and payment application are certified compliant with the PA-DSS for developers;
3. The supplier hardware, equipment and devices are certified compliant with the Pin Transaction Security (PTS) standards for manufacturers;
4. The supplier devices are EMV (Chip and PIN) enabled, and also have End to End Encryption (E2EE) and/or Point to Point Encryption (P2P) to protect against fraudulent card attempts and attacks.

• Allow for review of Standard for Attestation Engagements SSAE No. 16 and provide the latest Attestation of Compliance or proof of PCI DSS certification upon request by the University.
• The University will not be responsible for any security breaches and will require third party service providers to indemnify the University for all costs and damages associated with security breaches caused as a result of negligence on the part of the service provider.

Breach, Data Compromise and/or Non-Compliance

Matters of non-compliance shall be addressed as follows:

1. If the merchant staff learns of non-compliance first, it must discontinue credit card processing and notify the KU Information Technology Security Office (ITSO) and E-commerce Committee. If ITSO or Financial Services learns of non-compliance first, they will contact the merchant to discontinue credit card processing.

2. Immediate notification must be made to the KU Information Technology Security Office and the E-commerce Committee. Phone: KU Information Technology Security Office (ITSO) – 785-864-9003. Email: ecommerce_dl@ku.edu and itsec@ku.edu.
3. The E-commerce Committee will coordinate further communication with the processor, hardware and/or software supplier, and any other identifiable entity to secure information and escalate the issue according to the procedures outlined in the IT Security Incident Response Policy: http://policy.ku.edu/IT/security-incident-response
4. To contain the exposure of a security incident, the E-commerce Committee will escalate the situation to disable operations through merchant services hardware, and/or software supplier depending on the nature of the breach, if network exposure may be at risk, or if a potential exists for additional cardholder data exposure. 

5. The breach, data compromise, and/or non-compliance situation will be assessed as to the nature, cause, and impact regarding customers, operations, and any immediacy to consider whether communications are warranted to involve law enforcement. ITSO will prepare an Incident Report and a list of compromised accounts. Financial Services will coordinate any actions with contracted merchant services.

6. E-commerce Committee and ITSO will work to coordinate and develop a plan to attain remediation. The remediation plan will be presented to ITSO leadership and Financial Services leadership for initial vetting and to Administration for approval.

7. A mutually agreeable timeline for the remediation will be established by the merchant and the E-commerce Committee.

8. A Self-Assessment Questionnaire (specific to the scenario) will be completed by the merchant and subject to review and approval by the E-commerce Committee to document that remediation has occurred.

9. Should remediation not be attained by the timeline established, the E-commerce Committee and the ITSO will consider further actions which may delay or not permit the merchant to resume operations.

10. When the remediation plan is fully executed and the status of applications, equipment, contract requirements, and procedures are restored to a compliant position, the E-commerce Committee is responsible for determining operating status with an overriding decision of the Chief Financial Officer & Vice Chancellor for Finance and the Chief Information Officer.

11. The merchant will enforce any additional safeguards or steps presented for further operational success.

As a consequence of a breach, data compromise, or non-compliance, the merchant may incur increased costs due to fines imposed by card brands and/or potential loss of the contractual relationship to operate card processing.

A persistently non-compliant merchant is subject to suspension of card acceptance processing by the E-commerce Committee.