Payment Card Industry Data Security Standard (PCI DSS) Policy

The State University of New York College at Plattsburgh (“College”) is committed to safeguarding personal information entrusted to it during the normal course of business. Maintaining the privacy of payment card information is a critical element of this stewardship. Adhering to the recognized PCI DSS Standard protects against data breach and identity theft, safeguards the College’s reputation, and ensures compliance with industry-mandated requirements. Therefore, the College will take appropriate measures to protect cardholder data as defined in this policy and related procedures.

Date	Version Number	Change Description	Referenced Section
1/23/17	1.0	New Document	Entire Document
11/1/18	1.1	Minor Revisions	7.0
12/2/18	1.2	Minor Revisions

 Review Process / Approval

Action:	Units	Date
Policy Review	Student Accounts Management Services
Policy Approval	Executive Council	1/23/17

All employees or volunteers of the College, College-affiliated organizations, contractors, or consultants that handle cardholder data on behalf of the College and its affiliated organizations ("Covered employee").

Please note: A comprehensive list of PCI DSS definitions can be found in PCI Security Standard Council Glossary ("Glossary") All uses of terms in this policy and any related procedures are in conformance with the definitions found in the Glossary (See Appendix). Any additional terms are defined below.

College Affiliated Organization –  College Auxiliary Services, Plattsburgh Alumni Association, Plattsburgh College Foundation, and the Research Foundation for the State University of New York. 

PCI DSS Standard – Refers to the latest version of the PCI DSS Standard as approved by the PCI Security Standard Council. As of June 2016, the latest version is 3.2.

Covered employees – Responsible for complying with this policy and all related procedures.

Department Supervisors – Responsible for ensuring compliance with this policy and any related procedures promulgated by the PCI DSS Compliance Committee.

PCI DSS Compliance Committee – Responsible for oversight and coordination of campus PCI DSS Compliance efforts, including the establishment and promulgation of related PCI-compliant procedures for handling cardholder data, monitoring and evaluating department compliance with PCI-DSS standard, and approving department-requested deviations from those procedures.

Vice President for Administration – Responsible for approving department requests to handle payment cards and for revoking authorization to handle cardholder data.

SUNY PLATTSBURGH PCI DSS POLICY AND PROCEDURE MANUAL

None

Related Resources

PCI DSS Standard

PCI Security Standard Council

PCI Security Standard Glossary

SUNY Plattsburgh Information Security Program

Method	Date
Campus Handbook	N/A
Faculty / Staff Digest	N/A
Student Digest	N/A
Other	N/A

There are no specific trainings identified with this policy.