Re: PCI - Third party vendors

[Brad Judy <brad.judy () CU EDU>]

If they hold the merchant account, and they are treating your network like the internet (untrusted, public network), 
then they are responsible for ensuring both their compliance and that their data is properly protected before reaching 
your network.

However, if they are not treating your network like the public internet, then you could be considered a PCI service 
provider to them and you would need an agreement about who handles what aspects of security and would have to figure 
out your side of PCI compliance.

These arrangements can be fairly simple if you are just their ISP and not managing their internal networking.  They 
would typically have their own switch and SOHO type firewall to segment themselves from your network, only sending out 
the encrypted connection to the payment gateway/processor.  If you had a big chain coming on site, they would likely 
have done this approach before.

That said, a local coffee shop might not understand PCI-DSS and might not have a plan like that.

Brad Judy

Director of UIS Security
University Information Systems
University of Colorado
1800 Grant Street, Suite 300
Denver, CO  80203
Office: (303) 860-4293
Fax: (303) 860-4302
www.cu.edu

[cid:8B31C7DD-0324-46B9-83BC-2307D4D96284]


From: <Drake>, Craig <c-drake () NEIU EDU<mailto:c-drake () NEIU EDU>>
Reply-To: EDUCAUSE Listserv <SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV EDUCAUSE EDU>>
Date: Thursday, July 24, 2014 2:30 PM
To: EDUCAUSE Listserv <SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV EDUCAUSE EDU>>
Subject: [SECURITY] PCI - Third party vendors

We have a new coffee shop going into our library.  They are completely run by an external entity not associated with 
the university.  They want to connect their terminals to our university network (possibly wireless) to transmit their 
credit card transactions.  What do we need to be concerned with in terms of PCI compliance with them running this 
through our networks?

Thank you,
-Craig

Craig Drake

University Technology Services
Northeastern Illinois University
5500 North St. Louis Avenue, Chicago, IL 60625
Phone: (773) 442-4386
Email: C-Drake () neiu edu<mailto:C-Drake () neiu edu>

www.neiu.edu<http://www.neiu.edu>

[http://homepages.neiu.edu/~markdep/images/neiu_wordmark_color_email.png]