Deficiencies in a merchant’s ability to appropriately secure cardholder data is the foundation of a potential data breach.

As a result, these deficiencies deem the merchant account non-compliant with the PCI governance framework. If a merchant does not appropriately store, process, or transmit cardholder data as defined by Policy UW-3031, deficiencies exist in that merchant account’s standard operating procedures. This procedure should be understood by all relevant personnel including Divisional Business Representatives (DBRs), Site Managers, and Operators of the merchant accounts. This procedure applies to all UW–Madison departments that accept payment cards via payment card terminals.

Persistent noncompliance after the enactment of the disciplinary steps described in this procedure may result in the suspension or termination of the non-compliant merchant account. The purpose of this procedure is to provide a framework for the disciplinary steps that will be taken in the event a UW–Madison merchant account is found to be non-compliant with Policy UW-3031 and the PCI DSS. All merchants who accept payments via payment card must comply must comply with Policy UW-3031 and the Payment Card Industry Data Security Standards (PCI DSS). The University of Wisconsin-Madison has merchant accounts which accept payment for goods sold and services rendered via payment card transactions.

Related Policy: UW-3031 Credit Card Merchant Services and PCI Compliance Policyįunctional Owner: Cash Management, Business ServicesĬontact: PCI Mailbox: Procedure statement Procedure # 3031.C Rev.: 1 (Effective September 1, 2020)

Posting to the Student Information System (SIS).

Cash management point of sale reviews