INSTRUCTIONS FOR COMPLETING YOUR FY15 SAQ S

Transcription

1 INSTRUCTIONS FOR COMPLETING YOUR FY15 SAQ S Please use the link and login credentials provided in the received along with this presentation from Treasury to complete your FY15 Self-Assessment Questionnaires. Please note: If you have MIDs under more than one Processor (ie: Elavon or Global Payments), you will receive separate logins to complete separate SAQ s, for each processing type by Processor. This means, depending on your current environment, you could receive up to (but no more than) 6 login credentials to complete 6 separate SAQs The following slides will help you navigate through completing your SAQs once you ve logged into Trustkeeper. Should you have any questions along the way that are not already addressed within this presentation, please reach out to Katie Todd or send a note to creditcards@columbia.edu.

2 PCI DSS is NOT check-the-box security Yes, there are checkboxes on the SAQ But if you do it without reading the instructions, Or if you do it without gathering the documentation You re doing it wrong!

3 BEFORE YOU BEGIN Before you begin the SAQ, you should review and familiarize yourself with the most recently updated Payment Card Industry Data Security Standard (PCI-DSS) v 3-1. Copy & paste the following URL into a browser to open the PCI-DSS v3.1 Upon completing your SAQ, you will be asked to verify that you have read the PCI-DSS and recognize that you must maintain PCI DSS compliance at all times.

4 WHEN YOU RE READY TO BEGIN Be sure to login to Trustwave using the credentials provided to you by Treasury to complete the SAQ s. Once logged in, click Start as indicated below

5 How do You Accept Credit Cards? Select only ONE from the options below. Remember if you accept credit cards by more than one of the below means, you will receive separte login credentials to complete more than one SAQ. *You will complete one SAQ per processing type* (So if you accept credit cards by all three types, you will complete 3 SAQ s, under each processor)

6 More Details on How you Accept Credit Cards The next few questions depend on how you answered the previous question. **Be sure to read the descriptions and understand each before choosing

7 SIDE NOTE Occasionally, depending on how you answer specific questions, you may see a pop-up with additional questions. Be sure to answer them accurately. If you are unsure, choose I m not sure for your answer.

8 Next Steps Once you click Next as shown below, you will confirm details about your Merchant Profile and Business Environment.

9 Merchant Profile Be sure all of your General Info is correct here. Especially your address Make any corrections as necessary. The Company Name should be the Processing Type for the MIDs you re completing this SAQ for. (ie: Website, Mail/Telephone or In Person)

10 Merchant Profile cont. Under Additional Info : A Service Provider can be any of (but not limited to) the following: Payment gateways (CyberSource or Virtual Merchant), A Web Hosting provider Any consultants Any calendar/event application software Providers **An Acquirer is your Processor: Elavon Global Payments Chase **PLEASE NOTE: Even if you have Merchant Accounts with more than one of the above Acquirers/Processors, you must still select No under Multiple Acquirers. As you will complete a separate SAQ for each Acquirer/Processor.

11 Merchant Profile cont. The person that completed the Wizard is whomever answered all the previous questions regarding processing type. If this is different from the individual already listed, type your name where applicable, under the Second or Third Person section Then click Next

12 Merchant Profile cont. On this screen, be sure that if you have multiple MIDs with the same Processing Type, that they are ALL listed here: If any MIDs are missing OR if you see any MIDs listed that should not be listed here because they process differently, please contact the following to discuss and correct:

13 Business Environment You must verify that this screen reflects your credit card acceptance program as you described in previous sections for each of the MID(s) listed on the previous screen. You can make any changes by clicking on Previous or Change Or If no changes are required, click Next

14 Business Environment Cont.. Any terminals (ie: Verifone, Synergy, Hypercom, etc), or online software applications (ie: CyberSource, Virtual Merchant, Paymentech, TrustCommerce) must be listed here. To list your products, click Add Product **All products for each of your MIDs listed under the Merchant Profile must be listed here**

15 Adding Products After you ve clicked, start typing your product name in space provided, when you see your product name, select that product. **If your product does not pre-populate after typing it in, click and enter the info for your product as instructed.

16 SIDE NOTE For every MID that you saw listed under your Merchant Profile You MUST list all terminals, software applications, etc. used for each of those MIDs here

17 Business Environment Cont.. If you selected WEBSITE, when describing how you accept credit cards earlier You must list all URLs where customers can register and pay for products, services, events, et al. by clicking Add Web Site and entering the website links, one by one.

18 SIDE NOTE For every MID that you saw listed under your Merchant Profile that is an e-commerce MID You MUST list a URL for each here:

19 Business Environment Cont.. Here you will list all of your Service Providers, click Add Service Provider Service Providers include: Processors (Elavon, Global Payments, et al) Web hosting vendors Consultants Call centers Bill collectors Web developers *If you have any Service Providers not already provided in the list, click Add New

20 QUESTIONNAIRE Select the Step-by- Step method and click Next

21 QUESTIONNAIRE The specific questions that will follow will vary significantly, based on your answers to previous questions, and must be answered as accurately as possible. The next few slides provide helpful guidance for navigating through the Questionnaire.

22 HELPFUL GUIDANCE Click on the for information on the importance of the question. Hover over items in bold print for further clarification

23 Read descriptions carefully to ensure you answer the questions as accurately as possible HELPFUL GUIDANCE

24 Equipment Inventory You are required to maintain a list of all of your payment equipment. This list should include: the make and model of the device the location and a serial number or other identifier Please upload your documented list by following the instructions on the next slide. ***You may choose to upload your documentation at a later time***

25 Uploading Required Documentation To upload documentation, click on the along the top of the Trustkeeper site tab Then click and follow the prompts for uploading your documents. ***You may choose to upload your documentation at a later time***

26 Manually Inspecting Terminals If you use a Point of Sale terminal to accept credit cards, please designate someone to partake in the following training Fraud Prevention for Merchants (Right click on the above and click Open Hyperlink to access the training)

27 There are some security functions that are managed centrally by CUIT If you reach any questions that involve any of the following topics, please contact for assistance: Network Security Secure Communications Device & Computer Security Secure Management & Monitoring For any questions related to your Websites' configuration, please reach out to your IT / developers for assistance. Or contact creditcards@columbia.edu

28 Confirming your Self-Assessment Please review the descriptions for each SAQ type on the following slide to confirm you have completed the correct SAQ before checking the box highlighted below.

29 SAQ DESCRIPTIONS

30 Acknowledgement This MUST be completed by the SBO for the department