Credit 1xbet online games login Processing
Chapter 6115
Revised November 16, 2016
Table of Contents
.010Introduction
.020Credit 1xbet online games login Acceptance and Processing
.030Credit 1xbet online games login Payment Processor
.040 Training on Handling Confidential 1xbet online games login
.050 Handling Credit 1xbet online games login Information
.060 Technologies Used to Process 1xbet online games login Cards
.070Payment 1xbet online games login Industry Requirements
.080 Settlement
.090 Chargebacks
.100 No Disclosure of Cardholder 1xbet online games login
.110 Questions
.120 Contract Language for Payment 1xbet online games login Industry (PCI) Data Protection
.130 Related Policies
.010 Introduction
This chapter provides guidance concerning the acceptance of credit cards in payment for fees, products and services at Kansas State University. In accordance with Kansas Statutes Annotated 75-30,100(a), any state agency which imposes or collects fees, tuition or other charges shall accept payment thereof in the form of a personal, certified or cashier's check or money order. Kansas State University, a state agency, may accept payment by credit 1xbet online games login or other method designated by the agency. Kansas State University has adopted the following policies and procedures to assist departments which accept credit 1xbet online games login payments.
.020 Credit 1xbet online games login Acceptance and Processing
The Division of Financial Services will facilitate the acquisition of credit 1xbet online games login equipment and assess credit 1xbet online games login processing fees to departments. The department will be responsible for installing any telephone line for the credit 1xbet online games login terminal, if needed. The acceptance of credit cards does not alter the need of an official receipt or other approved method of issuing a receipt and the depositing of receipts. The department is to close the batch on any credit 1xbet online games login terminal daily. Funds associated with the batch will be automatically deposited into each department’s default account. Should these funds belong in a different account the department must complete a CASHNET Red/Black deposit to move them. Credit 1xbet online games login transactions from storefront activity or checkouts within the CASHNET system do not need to be closed out.
All technology implementation associated with the credit 1xbet online games login processing must be in accordance with the Payment 1xbet online games login Industry Data Security Standards (PCI DSS). The cost of equipment or other related measures for compliance to standards will be the responsibility of the 1xbet online games login .
The cost of processing credit cards (discount fees, interchange fees, etc.) will be paid from departmental funds and the expenditure document will be prepared by the Division of Financial Services for all campus departments. The University is centrally invoiced by the credit 1xbet online games login processor and the Division of Financial Services distributes the cost to departments based on the departmental portion of the service charges.
No employee of the university is to advance any cash to the cardholder in connection with the 1xbet online games login transaction. Credit cards payments shall be used for the sole purpose of processing payment transactions for goods and/or services provided by Kansas State University to the cardholder.
.030 Credit 1xbet online games login Payment Processor
Departments must use the credit 1xbet online games login payment processors under contract with Kansas State University. This contract provides for the acceptance of Visa, MasterCard, Discover and American Express. The fees for processing credit cards vary according to the type of 1xbet online games login and how it is processed. The equipment needed to handle credit cards must be purchased through Kansas State University’s contract vendor. The Division of Financial Services, (785) 532-1834, will provide assistance to the department in contacting the contract vendor to purchase appropriate equipment and configure software.
The University honors without discrimination valid credit cards properly tendered for use. In accordance with the State of Kansas contract, no entity can set a dollar amount above or below which it can refuse to honor otherwise valid cards. Each sale the university makes involving a credit 1xbet online games login must be evidenced by a single sales data record completed with the sale date and the sale amount, and the information as required by the Associations or by the credit 1xbet online games login processor.
In the case of when the payment is received by mail, telephone, or pre-authorized transaction, it is the responsibility of the University to have reasonable procedures in place to ensure that each 1xbet online games login sale is made to a purchaser who actually is the cardholder or is the authorized user of the 1xbet online games login . Each department is responsible for keeping payment transaction records as without them the University, in accordance with the State of Kansas contract, cannot refute a chargeback if the cardholder disputes making a purchase.
1xbet online games login Third Parties
In limited applications departments may use other third parties to assist with accepting 1xbet online games login cards for the sale of services and products. For example, a third party may host an e-commerce web site for the department or provide support for a special-purpose application like a point-of-sale system. The Division of Financial Services maintains a list of service providers. The department that contracts with the third party must manage the relationship with the third party to ensure that Kansas State University’s data is properly protected. This includes the following:
- Before entering into a contract with a third party to process, store, or transmit credit 1xbet online games login information on behalf of Kansas State University, the third party must be approved by the Division of Financial Services and their PCI DSS compliance reviewed by the Office of Information Security and Compliance in IT Services.
- The contract 1xbet online games login include the language in section .120 below, “Contract Language for Third Parties.”
- The department 1xbet online games login verify the third party’s PCI DSS compliance status annually and submit the compliance documents to the Division of Financial Services. Departments should also keep a copy. Examples of appropriate compliance documentation include a reference to their entry in the PCI 1xbet online games login Standards Council’s list of Validated Payment Applications, or a copy of the official notification received by the third party from the PCI 1xbet online games login Standards Council stating their payment application was certified and the date the payment application was last validated.
.040 Training on Handling Confidential 1xbet online games login
In accordance with PPM Chapter 3415, credit 1xbet online games login information is protected and considered under the Information Security Plan. All credit 1xbet online games login information is to be treated as Confidential data and is to be handled appropriately. In accordance with PCI DSS, all employees involved in processing credit 1xbet online games login transactions and the support of the cardholder data environment (CCNet) must be trained annually on the appropriate procedures. All new employees, including students, are to undergo a background check before they can process credit 1xbet online games login transactions.
All departments accepting credit 1xbet online games login transactions will identify a PCI Manager who is responsible for maintaining a list of all personnel who have access to credit 1xbet online games login information or access to equipment, software and procedures used to process credit 1xbet online games login payments. Credit 1xbet online games login equipment will be inspected periodically for evidence of tampering.The Division of Financial Services and the Office of Information Security & Compliance are responsible for conducting training sessions for all personnel who work with credit 1xbet online games login transactions. Please contact the Division of Financial Services at (785) 532-6211or the Office of Information Security & Compliance at (785) 532-2540 if you have questions regarding these sessions.
.050 Handling Credit 1xbet online games login Information
All credit 1xbet online games login information is to be kept to a minimum. The storage and retention of any credit 1xbet online games login information must be limited to what is required for business, legal and/or regulatory purposes, as documented in the data retention policy. No credit 1xbet online games login information is to be retained unless protected in accordance with 1xbet online games login .
The receipt printed by the credit 1xbet online games login terminal or any other printer is to truncate all the digits of the credit 1xbet online games login number except for the first six and last four digits of the primary account number (PAN). The expiration date is not to appear on the customer’s copy. If the complete number is listed or the expiration date appears on any of the credit cards receipts, the equipment is to be re-programmed or the equipment is to be replaced with equipment that complies with these requirements.
Access to credit 1xbet online games login information must be strictly limited to those who have a business reason to access it. For those individuals, access should be limited to the least privileges needed to perform their job responsibilities, based on their job classification and function. Access rights must be approved either in writing or electronically by an appropriate authority, such as the department’s business manager or the employee’s supervisor, specifying the required privileges. This can be included in one’s initial employment letter or an in email sent to the employee. Provide the following information in the authorization documentation:
- Employee name
- Position title
- Description of their interaction with credit 1xbet online games login information (i.e., the access privileges granted)
- Credit 1xbet online games login technologies to be used (e.g., 1xbet online games login swipe terminal, point of sale register, CASHnet via the web, etc.)
- Name of person authorizing 1xbet online games login
- Position title of person authorizing 1xbet online games login
- Date of 1xbet online games login authorization
User accounts that have access to credit 1xbet online games login information must be managed to ensure appropriate security and access controls are enforced. This includes managing authentication, account creation and deletion, and assigning and removing privileges as roles change. Administration of accounts that use K-1xbet online g is the responsibility of 1xbet online games login Technology Services. Accounts in CASHNet are managed by the Division of Financial Services. Responsibility for managing any other accounts, such as departmental systems and applications, must be assigned by the appropriate authority within that department (e.g., the unit’s business manager or department head).
If a credit 1xbet online games login number is provided over the telephone or through the mail, only authorized and trained employees are to have access to this information. As soon as the transaction is entered into the credit 1xbet online games login terminal the form containing credit 1xbet online games login information should be shredded in a cross-cut shredder. If a “to-be-shredded” container is used to dispose of cardholder data, it must have a lock to prevent unauthorized access. If cardholder data is stored electronically, the data must be securely deleted when it is no longer needed for business or legal reasons.
If the documentation that contains credit 1xbet online games login information is required to be retained, the documentation is to be accessible only to employees who are authorized and trained. The documentation is to be secured at all times, marked “Confidential” and stored in a locked area or cabinet with access permitted to only authorized and trained employees. Inventory logs of documentation that contains credit 1xbet online games login information must be maintained and an audit of the logs must be completed annually. Management must approve the removal of documentation containing credit 1xbet online games login information from a secured area.
If credit 1xbet online games login information must be provided on paper to another department, the paper containing credit 1xbet online games login information must be enclosed in a sealed envelope, marked "Confidential", and transported by a personal courier. The document(s) must be checked out by the sending department and checked in by the receiving department to provide a paper trail on how the document(s) was exchanged. These check-out/check-in logs are to be retained by the department with retention periodically verified via audit. Departments are prohibited from using campus mail to send credit 1xbet online games login data.
No credit 1xbet online games login information is to be requested to be sent through email. Also, credit numbers must never be sent by end-user messaging technologies (for example, instant messaging, chat, etc.). The Office of Information Security & Compliance strictly prohibits the collection of credit 1xbet online games login data by email or end-user messaging.
Most credit 1xbet online games login terminals provide for a deposit report and a detailed transaction report at the end of each day from the credit 1xbet online games login terminal. The terminal should be programmed so these reports provide at most: the last four digits of the credit 1xbet online games login number, the number of transactions, and the transaction amounts necessary for recording and depositing the funds received. One copy of the deposit report is to be retained by the department with a signed copy of each credit 1xbet online games login transaction receipt.
If payment was received from the customer by use of a credit 1xbet online games login , any refund is to be made to the same credit 1xbet online games login originally used. Cash or refund checks are not acceptable reimbursement methods for credit 1xbet online games login sales as they are not accepted as proof of a refund by the merchant bank should the cardholder also request a chargeback from the merchant.
Remote 1xbet online games login
Access from off campus to any systems on campus in the cardholder 1xbet online games login environment (i.e., in CCNet), must be restricted to those with a business need for remote access, such as a system administrator or vendor providing remote support. Other requirements include:
- Two-factor authentication 1xbet online games login used to verify their identity.
- Remote access sessions 1xbet online games login disconnect automatically after 15 minutes of inactivity.
- Remote access by a vendor or other business partner 1xbet online games login only be enabled when needed and deactivated as soon as their work is completed.
- Copying, moving, or storing cardholder 1xbet online games login onto a local drive or removable electronic media (like a USB flash drive) is prohibited during a remote access session unless explicitly authorized for a defined business need.
.060 Technologies Used to Process 1xbet online games login Cards
All credit 1xbet online games login processing involves technology in some manner, whether a web server accepting online orders, a 1xbet online games login swipe terminal connected to a phone line or the campus data network, or an office workstation used to manually enter phone or mail-in orders. All technologies involved in processing credit cards must be secured according to the requirements of the Payment 1xbet online games login Industry Data Security Standard (PCI DSS) and used in accordance with all K-State policies and procedures. In addition, the below requirements must be followed.
- All technologies used in credit 1xbet online games login processing must be approved by the Division of Financial Services and installed by a qualified technician.
- All such technologies that use K-State’s data network, including but not limited to servers, kiosks, 1xbet online games login swipe payment stations, point-of-sale registers, etc., must connect to and use the secure Credit 1xbet online games login Network (CCNet).
- All such technologies may only be used for purposes related to the business function for which credit 1xbet online games login payments are accepted. For example, you cannot do general email and web browsing on an office workstation that is used to enter credit 1xbet online games login information into a payment application. That workstation must be used solely for the functions related to the payment application.
- All devices in the secure Credit 1xbet online games login Network (CCNet) must have the latest anti-virus software installed, running, and receiving current anti-virus signatures.
- The Division of Financial Services and the Office of Information Security and Compliance will maintain an inventory of all technologies used to process 1xbet online games login cards. This inventory includes contact information for the device, its purpose, and the department responsible for it. The contact person for each device is responsible for maintaining a list of all personnel approved to use the device. The device must be labeled with an identifier that will allow the physical device to be associated with its inventory record, such as its serial number (i.e., a “logical label” that allows one to identify its owner, purpose, and contact information).
- Only 1xbet online games login swipe terminals and mobile payment solutions approved by or provided by K-State’s acquiring bank, Bank of America, may be used. Exceptions must be approved by the Division of Financial Services and certified by PCI as approved PIN transaction security devices.
- Departments are required to periodically inspect credit 1xbet online games login equipment (1xbet online games login swipe terminals, etc. ) to detect tampering or substitution of a fraudulent device. Any suspicious indications should be reported to the Division of Financial Services immediately.
- Payment applications used to process 1xbet online games login cards must be certified to be compliant with PCI's Payment Application Data Security Standards (PA-DSS). This includes payment applications hosted off campus by third parties as well as those hosted on campus.
- Authentication with a unique username and strong password that meets K-State’s password requirements 1xbet online games login used on all technologies that support authentication.
- Passwords for the following types of accounts must be changed at least every 90 days: Accounts with administrative privileges on the systems involved in the processing, storage, or transmission of credit 1xbet online games login information (e.g., system administrators of workstations and servers in CCNet, or application administrators with privileged access to a point-of-sale application.) OR Accounts that can access more than one full credit 1xbet online games login number at the same time (cashiers who process a single credit 1xbet online games login at a time are NOT subject to this requirement.)
- K-State's Credit 1xbet online games login Policy contains additional requirements. See section .050 Credit 1xbet online g of PPM 6110 for more 1xbet online games login .
.070 Payment 1xbet online games login Industry Requirements
The companies of all credit cards which are accepted by the University require all merchants and credit 1xbet online games login processors store, transmit or process credit 1xbet online games login holder information in compliance with Payment 1xbet online games login Industry requirements. The PCI DSS consist of 12 requirements:
Build and Maintain a Secure Network
- Install and maintain a firewall configuration to protect cardholder 1xbet online games login .
- Do not use vendor-supplied defaults for system passwords and other 1xbet online games login parameters.
Protect Cardholder 1xbet online games login
- Protect stored cardholder 1xbet online games login .
- Encrypt transmission of cardholder 1xbet online games login across open, public networks.
Maintain a Vulnerability Management Program
- Use and regularly update anti-virus software and programs.
- Develop and maintain secure systems and applications.
Implement Strong 1xbet online games login Control Measures
- Restrict access to cardholder 1xbet online games login by business need to know.
- Assign a unique ID to each person with computer 1xbet online games login .
- Restrict physical access to cardholder 1xbet online games login .
Regularly Monitor and Test Networks
- Track and monitor all access to network resources and cardholder 1xbet online games login .
- Regularly test 1xbet online games login systems and processes.
Maintain an 1xbet online games login Security Policy
- Maintain a policy that addresses 1xbet online games login security for all personnel.
Before any department can accept 1xbet online games login cards, these 12 requirements must be in place. Non-compliance to these standards can result in significant fines assessed to the University. Kansas State University may pass some or all fines to the department involved with any security breach.
In order to ensure compliance with PCI DSS, departments that accept credit 1xbet online games login payments must complete an annual PCI Self-Assessment Questionnaire. K-State must conduct a formal risk assessment annually to identify threats and vulnerabilities to the secure Credit 1xbet online games login Network (CCNet). This policy must be reviewed annually and updated when the credit processing environment changes. The Office of Information Security and Compliance is responsible for developing daily operational security procedures for the secure Credit 1xbet online games login Network (CCNet).
.080 Settlement
As each department with physical credit 1xbet online games login terminals closes their batches at day end a data file is created with our credit 1xbet online games login processor. This data file is sent electronically to Kansas State University's Division of Financial Services and the funds in that batch are deposited directly into each Department’s default project account. The department is responsible for reconciling their transactions against FIS reports and, when necessary, using CashNet to move funds between projects and revenue codes. Training on this settlement 1xbet online games login can be found on the Financial 1xbet online games login Website under Cashiers/Training.
.090 Chargebacks
The University may receive a chargeback from a Cardholder or 1xbet online games login issuer if: they fail to issue a refund to a cardholder upon the return or non-delivery of goods or services, an authorization code was required and not obtained, the sales data was prepared fraudulently, or the cardholder disputes the 1xbet online games login sale.
.100 No Disclosure of Cardholder 1xbet online games login
Employees shall exercise reasonable care to prevent disclosure of credit 1xbet online games login information, other than to authorized entities for the purpose of assisting the University in completing a 1xbet online games login transaction. The University and its credit 1xbet online games login processor will store all media containing 1xbet online games login numbers in an area limited to personnel with a need to know and any material containing credit 1xbet online games login information will be destroyed in a manner rendering the primary account number unreadable. If at any time account number information has been compromised, notification is to be made immediately. K-State has an incident response plan in place so the university can respond effectively in the event of a breach of cardholder data. The Office of Information Security and Compliance is responsible for testing the incident response plan and providing training to appropriate staff on an annual basis. View the incident 1xbet online games login ma.
.110 Questions
Any questions regarding the processing of 1xbet online games login cards may to be referred to the Division of Financial Services (785) 532-6210.
.120 Contract Language for Payment 1xbet online games login Industry (PCI) Data Protection
The following language must be included in all contracts with third parties that handle credit 1xbet online games login information on behalf of Kansas State University.
Whereas, Kansas State University is a merchant that conducts transactions that include credit 1xbet online games login payments and <vendor is a service provider that provides hosted applications on behalf of Kansas State University, both parties must protect all system components included in or connected to the cardholder data environment in accordance to Payment 1xbet online games login Industry Data Security Standard (PCI DSS).
- "Cardholder 1xbet online games login " shall mean any personally identifiable 1xbet online games login associated with a cardholder, including, by way of example and without limitation, a cardholder's account number, expiration date, name, or address.
- "System Components" include network components, servers, 1xbet online games login services, and applications.
<Vendor acknowledges when systems provided by <vendor could affect the security of cardholder 1xbet online games login , they shall protect that 1xbet online games login in accordance with requirements specified in the PCI DSS. <Vendor is responsible to provide protection for all systems that could affectthe security of cardholder 1xbet online games login .
<Vendor agrees to comply with the following requirements:
- Will provide, in writing, the 1xbet online games login and system components which are included in the scope of their PCI DSS assessment and specify which PCI DSS requirements in which they validated against. (per PCI DSS requirement 12.9)
- Validate compliance with the PCI DSS on an annual basis and provide Kansas State 1xbet online games login with an Attestation of Compliance (AOC).
- Agrees to hold all data and information received from or created on behalf of Kansas State 1xbet online games login in strict confidence.
- Contract specifies permitted uses, if any, of Kansas State 1xbet online games login 's data and information.
- If Kansas State 1xbet online games login cardholder data is compromised or suspected to have been compromised as a result of systems hosted by <vendor, they will provide notice to Kansas State 1xbet online games login of actual or potential data breach within forty-eight(48) hours.
- If an investigation of the data breach is requested by Kansas State 1xbet online games login , <vendor shall provide access to systems and staff to conduct the investigation and will support both Kansas State 1xbet online games login staff, contractors, and law enforcement to conduct the investigation.
- Agrees that, upon Kansas State 1xbet online games login 's request in the event of a data breach, <vendor will provide a representative or a PCI approved third party designated by Kansas State 1xbet online games login with full cooperation and access to conduct a thorough security review; the review shall include, at a minimum, validation of <vendor's compliance with the PCI DSS for protecting cardholder data.
- In the event <vendor fails to adhere to any of data security provisions set forth and as a result, cardholder data is obtained by unauthorized persons, <vendor agrees to pay, upon written demand by Kansas State 1xbet online games login , all documented costs associated with a data breach.
- In the event that the contract is terminated for any reason, <vendor shall return the cardholder data to Kansas State 1xbet online games login and provide confirmation that all remnants of cardholder data stored by <vendor are destroyed in a manner that renders the data unrecoverable.
