Title
Payment Card Industry Data Security Standard Policy.
Body
Recommended Action: Recommend adoption of policy.
The purpose of this policy is to define the guidelines for accepting and processing payment cards, and storing personal cardholder information. The policy will ensure that cardholder data supplied to Sedgwick County is secure and protected. Sedgwick County departments and divisions will comply with data security standards set out by Sedgwick County and in accordance with the Payment Card Industry Data Security Standards (PCI DSS).
Statistics:
In 2016 there were 35,512 card transactions totaling $14,270,684.16.
21,778 card transactions totaling $5,244,966.18 from departmental machines.
13,734 online transactions that totaled $9,025,717.98.
Alternatives: Do not approve policy which would make Sedgwick County non-compliant with PCI DSS. PCI is not, in itself, a law. The standard was created by the major credit card brands, Visa, MasterCard, Discover, AMEX and JCB. At their acquirers’/service providers’ discretion, merchants that do not comply with PCI DSS may be subject to fines, card replacement costs, costly forensic audits, brand damage, etc., should a breach event occur. Sedgwick County is a Level 4 merchant. 2017 is the first year that Visa is requiring Level 4 merchant compliance. Since this is a new requirement, there are no established fine/fee schedule established. There is precedent where non-compliant Level 4 merchants have been fined $40 per merchant. Sedgwick County currently has 28 merchants.
Financial Considerations: N/A
Legal Considerations: N/A
Policy Considerations: