Bank Card Processing - Revision history

Mhurlocker: /* Additional Information */

2024-08-19T20:10:25Z

Additional Information

← Older revision		Revision as of 15:10, August 19, 2024
Line 60:		Line 60:
	*See the [[Bank Card Handling Procedures]]<br />		*See the [[Bank Card Handling Procedures]]<br />

	This page maintained by [mailto:~~dpanowic~~@unmc.edu ~~dkp~~].		This page maintained by [mailto:mhurlocker@unmc.edu mh].

Mhurlocker: updated Controller email

2023-07-26T16:08:19Z

updated Controller email

← Older revision		Revision as of 11:08, July 26, 2023
Line 57:		Line 57:
	All bank card transactions will be processed in conformance with the Payment Card Industry Data Security Standards. A secure network environment is established for processing bank card transactions. A vulnerability management program is in place to ensure that the technical controls are functioning properly. Technical controls are in place to ensure that identity and access management is limited to those with a need to access the data in order to perform their job duties. Appropriate audit logging is enabled in order to track and monitor access. In the case of an information security event is found (such as an unauthorized wireless access point), the organization will follow the Incident Response Security Procedure. All members of UNMC complete annual information security compliance training.		All bank card transactions will be processed in conformance with the Payment Card Industry Data Security Standards. A secure network environment is established for processing bank card transactions. A vulnerability management program is in place to ensure that the technical controls are functioning properly. Technical controls are in place to ensure that identity and access management is limited to those with a need to access the data in order to perform their job duties. Appropriate audit logging is enabled in order to track and monitor access. In the case of an information security event is found (such as an unauthorized wireless access point), the organization will follow the Incident Response Security Procedure. All members of UNMC complete annual information security compliance training.
	==Additional Information==		==Additional Information==
	*Contact the [mailto:~~bfegley~~@unmc.edu Controller]		*Contact the [mailto:mhrncirik@unmc.edu Assistant Vice Chancellor for Business and Finance and Controller]
	*See the [[Bank Card Handling Procedures]]<br />		*See the [[Bank Card Handling Procedures]]<br />

	This page maintained by [mailto:dpanowic@unmc.edu dkp].		This page maintained by [mailto:dpanowic@unmc.edu dkp].

Afaylor: updated Finance Cashier link

2023-03-30T21:04:08Z

updated Finance Cashier link

← Older revision		Revision as of 16:04, March 30, 2023
Line 43:		Line 43:
	It is the policy of the University of Nebraska Medical Center that all bank card transactions on the UNMC campus will be under the control of the Controller. Web-based bank card transactions must utilize the standard UNMC application provided by Information Technology Services.		It is the policy of the University of Nebraska Medical Center that all bank card transactions on the UNMC campus will be under the control of the Controller. Web-based bank card transactions must utilize the standard UNMC application provided by Information Technology Services.
	==Bank Card Reporting ==		==Bank Card Reporting ==
	Bank card collections received by departments for UNMC will be submitted along with cash/check collections and a Cash Remittance Report to the [~~http~~://info.unmc.edu/cashering.~~htm~~ Finance Cashier].		Bank card collections received by departments for UNMC will be submitted along with cash/check collections and a Cash Remittance Report to the [https://info.unmc.edu/management/finance/cashering/index.html Finance Cashier].
	== Internal Controls ==		== Internal Controls ==
	*Departments will maintain written detailed internal procedures describing the proper handling of bank card transactions. These internal procedures must address the following, at a minimum;		*Departments will maintain written detailed internal procedures describing the proper handling of bank card transactions. These internal procedures must address the following, at a minimum;

Dpanowic at 16:14, July 20, 2021

2021-07-20T16:14:34Z

← Older revision		Revision as of 11:14, July 20, 2021
Line 30:		Line 30:
	Policy No.: '''6050'''<br />		Policy No.: '''6050'''<br />
	Effective Date: '''01/10/07'''<br />		Effective Date: '''01/10/07'''<br />
	Revised Date: '''~~06/30/14~~'''<br />		Revised Date: '''DRAFT'''<br />
	Reviewed Date: ~~'''06/30/14'''~~<br />		Reviewed Date: <br />

	'''<big>Bank Card Processing Policy</big>'''		'''<big>Bank Card Processing Policy</big>'''
Line 49:		Line 49:
	**Periodically inspect terminal surfaces to detect tampering (for example, addition of card skimmers to devices), or substitution (for example, by checking the serial number or other device characteristics to verify it has not been swapped with a fraudulent device).		**Periodically inspect terminal surfaces to detect tampering (for example, addition of card skimmers to devices), or substitution (for example, by checking the serial number or other device characteristics to verify it has not been swapped with a fraudulent device).
	**Personnel involved with bank card transactions must document knowledge of their awareness to attempted tampering or replacement of devices by completing the UNMC PCI 3.0 Point of Sale training material, which will be retained by the Finance Cashier.		**Personnel involved with bank card transactions must document knowledge of their awareness to attempted tampering or replacement of devices by completing the UNMC PCI 3.0 Point of Sale training material, which will be retained by the Finance Cashier.
	*Under no circumstances should bank card information be stored on any computer system. ~~This includes~~, but is not limited to: emails, ~~documents~~, ~~spreadsheets and databases~~.		*Under no circumstances should bank card information be stored on any computer system. Once a transaction is completed all digital information should be deleted from the computer in box and computer delete box. All paper information should be shredded including, but not limited to, all paper forms, printed emails, telephone memos, faxes, etc.
	*UNMC outsources e-commerce bank card processing. UNMC ITS Application Services has a module which is utilized to bridge the web application which accepts a bank card payment and the card processing company.		*UNMC outsources e-commerce bank card processing. UNMC ITS Application Services has a module which is utilized to bridge the web application which accepts a bank card payment and the card processing company.
	**All bank card transactions processed by UNMC Staff, on behalf of the customer, must go through the bank card terminals provided by the Finance Cashier. Under no circumstances, shall a UNMC Staff member enter a bank card number into a UNMC Web Application on behalf of the cardholder.		**All bank card transactions processed by UNMC Staff, on behalf of the customer, must go through the bank card terminals provided by the Finance Cashier. Under no circumstances, shall a UNMC Staff member enter a bank card number into a UNMC Web Application on behalf of the cardholder.
Line 55:		Line 55:
	All bank card transactions will be reviewed periodically and confirmed annually to assist in maintaining proper accountability and internal control. In addition, written departmental bank card procedures will be reviewed for conformity with UNMC policies, State Treasurer regulations, and Payment Card Industry Data Security Standards.		All bank card transactions will be reviewed periodically and confirmed annually to assist in maintaining proper accountability and internal control. In addition, written departmental bank card procedures will be reviewed for conformity with UNMC policies, State Treasurer regulations, and Payment Card Industry Data Security Standards.
	==Technical Controls==		==Technical Controls==
	All bank card transactions will be processed in conformance with the Payment Card Industry Data Security Standards. A secure network environment is established for processing of bank card transactions. A vulnerability management program is in place to ensure that the technical controls are functioning properly. Technical controls are in place to ensure that identity and access management is limited to those with a need to access the data in order to perform their job duties. Appropriate audit logging is enabled in order to track and monitor access. In the case of an information security event is found (such as an unauthorized wireless access point), the organization will follow the Incident Response Security Procedure. All members of UNMC complete annual information security compliance training.		All bank card transactions will be processed in conformance with the Payment Card Industry Data Security Standards. A secure network environment is established for processing bank card transactions. A vulnerability management program is in place to ensure that the technical controls are functioning properly. Technical controls are in place to ensure that identity and access management is limited to those with a need to access the data in order to perform their job duties. Appropriate audit logging is enabled in order to track and monitor access. In the case of an information security event is found (such as an unauthorized wireless access point), the organization will follow the Incident Response Security Procedure. All members of UNMC complete annual information security compliance training.
	==Additional Information==		==Additional Information==
	*Contact the [mailto:~~jeffrey.miller~~@unmc.edu Controller]		*Contact the [mailto:bfegley@unmc.edu Controller]
	*See the [[Bank Card Handling Procedures]]<br />		*See the [[Bank Card Handling Procedures]]<br />

	This page maintained by [mailto:dpanowic@unmc.edu dkp].		This page maintained by [mailto:dpanowic@unmc.edu dkp].

Dpanowic at 22:35, February 24, 2020

2020-02-24T22:35:14Z

← Older revision		Revision as of 17:35, February 24, 2020
Line 55:		Line 55:
	All bank card transactions will be reviewed periodically and confirmed annually to assist in maintaining proper accountability and internal control. In addition, written departmental bank card procedures will be reviewed for conformity with UNMC policies, State Treasurer regulations, and Payment Card Industry Data Security Standards.		All bank card transactions will be reviewed periodically and confirmed annually to assist in maintaining proper accountability and internal control. In addition, written departmental bank card procedures will be reviewed for conformity with UNMC policies, State Treasurer regulations, and Payment Card Industry Data Security Standards.
	==Technical Controls==		==Technical Controls==
	All bank card transactions will be processed in conformance with the Payment Card Industry Data Security Standards. A secure network environment is established for processing of bank card transactions. A vulnerability management program is in place to ensure that the technical controls are functioning properly. Technical controls are in place to ensure that identity and access management is limited to those with a need to access the data in order to perform their job duties. Appropriate audit logging is enabled in order to track and monitor access. In the case of an information security event is found (such as an unauthorized wireless access point), the organization will follow the Incident Response Security Procedure. All members of UNMC complete annual information security compliance training.~~<br />~~		All bank card transactions will be processed in conformance with the Payment Card Industry Data Security Standards. A secure network environment is established for processing of bank card transactions. A vulnerability management program is in place to ensure that the technical controls are functioning properly. Technical controls are in place to ensure that identity and access management is limited to those with a need to access the data in order to perform their job duties. Appropriate audit logging is enabled in order to track and monitor access. In the case of an information security event is found (such as an unauthorized wireless access point), the organization will follow the Incident Response Security Procedure. All members of UNMC complete annual information security compliance training.
	~~<br />~~		==Additional Information==
	~~For more detailed information, see the [[Bank Card Handling Procedures]] or contact~~ the [mailto:~~wlawlor~~@unmc.edu Controller].<br />		*Contact the [mailto:jeffrey.miller@unmc.edu Controller]
	~~<br />~~		*See the [[Bank Card Handling Procedures]]<br />

	This page maintained by [mailto:dpanowic@unmc.edu dkp].		This page maintained by [mailto:dpanowic@unmc.edu dkp].

Afaylor: remove | Electric Scooter from Business Operations menu

2019-08-02T17:35:00Z

remove | Electric Scooter from Business Operations menu

← Older revision		Revision as of 12:35, August 2, 2019
Line 26:		Line 26:
	</table>		</table>
	<br />		<br />
	[[General Accounting]] \| [[SBIR/STTR Program Participation]] \| [[Supplemental Compensation Plan]] \| [[Facilities Management/Planning]] \| [[Purchasing]] \| [[Public Affairs]] \| [[Facility Identification]] \| [[Serving Alcoholic Beverages]] \| [[Travel and Reimbursement]] \| [[State Vehicles]] \| [[Reproducing Copyrighted Materials]] \| [[Bank Card Processing]] \| [[Student Training Agreement]] \| [[Volunteer]] \| [[Cash Handling]] \| [[Fraud]] \| [[Assigning Research Lab Space]] \| [[Space Scheduling and Fundraising]] \| [[Academic Personnel Records]] \| [[Cellular Phone]] \| [[Off-campus Graphic Design and Related Printing]] \| [[Off-campus Photography]] \| [[Tax Exempt Financing and Tracking of Both Qualified Use and Non-Qualified Use of Research Space]] \| [[Secondary Logos]] \| [[Social Media]] \| [[Sensitive Equipment Tracking]] \| [[International Visitors]] \| [[Accounts Receivable Management]] \| [[Internal Audit]] \| [[Regulations on the Use of University Facilities and Grounds~~]] \| [[Electric Scooter~~]]		[[General Accounting]] \| [[SBIR/STTR Program Participation]] \| [[Supplemental Compensation Plan]] \| [[Facilities Management/Planning]] \| [[Purchasing]] \| [[Public Affairs]] \| [[Facility Identification]] \| [[Serving Alcoholic Beverages]] \| [[Travel and Reimbursement]] \| [[State Vehicles]] \| [[Reproducing Copyrighted Materials]] \| [[Bank Card Processing]] \| [[Student Training Agreement]] \| [[Volunteer]] \| [[Cash Handling]] \| [[Fraud]] \| [[Assigning Research Lab Space]] \| [[Space Scheduling and Fundraising]] \| [[Academic Personnel Records]] \| [[Cellular Phone]] \| [[Off-campus Graphic Design and Related Printing]] \| [[Off-campus Photography]] \| [[Tax Exempt Financing and Tracking of Both Qualified Use and Non-Qualified Use of Research Space]] \| [[Secondary Logos]] \| [[Social Media]] \| [[Sensitive Equipment Tracking]] \| [[International Visitors]] \| [[Accounts Receivable Management]] \| [[Internal Audit]] \| [[Regulations on the Use of University Facilities and Grounds]]
	<br /><br />		<br /><br />
	Policy No.: '''6050'''<br />		Policy No.: '''6050'''<br />

Afaylor: add Faculty tab and | Internal Audit | Regulations on the Use of University Facilities and Grounds | Electric Scooter menu links

2019-08-02T15:21:16Z

add Faculty tab and | Internal Audit | Regulations on the Use of University Facilities and Grounds | Electric Scooter menu links

← Older revision		Revision as of 10:21, August 2, 2019
Line 20:		Line 20:
	<td style="padding:0.5em; background-color:#e5e5e5; font-size:90%; line-height:0.95em; border:1px solid #A3B1BF; border-bottom:solid 2px #A3B1BF"		<td style="padding:0.5em; background-color:#e5e5e5; font-size:90%; line-height:0.95em; border:1px solid #A3B1BF; border-bottom:solid 2px #A3B1BF"
	width="20">[[Intellectual Property]]</td>		width="20">[[Intellectual Property]]</td>
			<td style="border-bottom:2px solid #A3B1BF" width="3"> </td>
			<td style="padding:0.5em; background-color:#e5e5e5; font-size:90%; line-height:0.95em; border:1px solid #A3B1BF; border-bottom:solid 2px #A3B1BF"
			width="20">[[Faculty]]</td>
	</tr>		</tr>
	</table>		</table>
	<br />		<br />
	[[General Accounting]] \| [[SBIR/STTR Program Participation]] \| [[Supplemental Compensation Plan]] \| [[Facilities Management/Planning]] \| [[Purchasing]] \| [[Public Affairs]] \| [[Facility Identification]] \| [[Serving Alcoholic Beverages]] \| [[Travel and Reimbursement]] \| [[State Vehicles]] \| [[Reproducing Copyrighted Materials]] \| [[Bank Card Processing]] \| [[Student Training Agreement]] \| [[Volunteer]] \| [[Cash Handling]] \| [[Fraud]] \| [[Assigning Research Lab Space]] \| [[Space Scheduling and Fundraising]] \| [[Academic Personnel Records]] \| [[Cellular Phone]] \| [[Off-campus Graphic Design and Related Printing]] \| [[Off-campus Photography]] \| [[Tax Exempt Financing and Tracking of Both Qualified Use and Non-Qualified Use of Research Space]] \| [[Secondary Logos]] \| [[Social Media]] \| [[Sensitive Equipment Tracking]] \| [[International Visitors]] \| [[Accounts Receivable Management]]		[[General Accounting]] \| [[SBIR/STTR Program Participation]] \| [[Supplemental Compensation Plan]] \| [[Facilities Management/Planning]] \| [[Purchasing]] \| [[Public Affairs]] \| [[Facility Identification]] \| [[Serving Alcoholic Beverages]] \| [[Travel and Reimbursement]] \| [[State Vehicles]] \| [[Reproducing Copyrighted Materials]] \| [[Bank Card Processing]] \| [[Student Training Agreement]] \| [[Volunteer]] \| [[Cash Handling]] \| [[Fraud]] \| [[Assigning Research Lab Space]] \| [[Space Scheduling and Fundraising]] \| [[Academic Personnel Records]] \| [[Cellular Phone]] \| [[Off-campus Graphic Design and Related Printing]] \| [[Off-campus Photography]] \| [[Tax Exempt Financing and Tracking of Both Qualified Use and Non-Qualified Use of Research Space]] \| [[Secondary Logos]] \| [[Social Media]] \| [[Sensitive Equipment Tracking]] \| [[International Visitors]] \| [[Accounts Receivable Management]] \| [[Internal Audit]] \| [[Regulations on the Use of University Facilities and Grounds]] \| [[Electric Scooter]]
	<br /><br />		<br /><br />
	Policy No.: '''6050'''<br />		Policy No.: '''6050'''<br />

Dpanowic at 20:53, December 15, 2016

2016-12-15T20:53:39Z

← Older revision		Revision as of 15:53, December 15, 2016
Line 23:		Line 23:
	</table>		</table>
	<br />		<br />
	[[General Accounting]] \| [[SBIR/STTR Program Participation]] \| [[Supplemental Compensation Plan]] \| [[Facilities Management/Planning]] \| [[Purchasing]] \| [[Public Affairs]] \| [[Facility Identification]] \| [[Serving Alcoholic Beverages]] \| [[Travel and Reimbursement]] \| [[State Vehicles]] \| [[Reproducing Copyrighted Materials]] \| [[Bank Card Processing]] \| [[Student Training Agreement]] \| [[Volunteer]] \| [[Cash Handling]] \| [[Fraud]] \| [[Assigning Research Lab Space]] \| [[Space Scheduling]] \| [[~~International Health Education]] \| [[Faculty~~ Personnel Records]] \| [[Cellular Phone]] \| [[Off-campus Graphic Design and Related Printing]] \| [[Off-campus Photography]] \| [[Tax Exempt Financing and Tracking of Both Qualified Use and Non-Qualified Use of Research Space]] \| [[Secondary Logos]] \| [[Social Media]]		[[General Accounting]] \| [[SBIR/STTR Program Participation]] \| [[Supplemental Compensation Plan]] \| [[Facilities Management/Planning]] \| [[Purchasing]] \| [[Public Affairs]] \| [[Facility Identification]] \| [[Serving Alcoholic Beverages]] \| [[Travel and Reimbursement]] \| [[State Vehicles]] \| [[Reproducing Copyrighted Materials]] \| [[Bank Card Processing]] \| [[Student Training Agreement]] \| [[Volunteer]] \| [[Cash Handling]] \| [[Fraud]] \| [[Assigning Research Lab Space]] \| [[Space Scheduling and Fundraising]] \| [[Academic Personnel Records]] \| [[Cellular Phone]] \| [[Off-campus Graphic Design and Related Printing]] \| [[Off-campus Photography]] \| [[Tax Exempt Financing and Tracking of Both Qualified Use and Non-Qualified Use of Research Space]] \| [[Secondary Logos]] \| [[Social Media]] \| [[Sensitive Equipment Tracking]] \| [[International Visitors]] \| [[Accounts Receivable Management]]
	<br /><br />		<br /><br />
	Policy No.: '''6050'''<br />		Policy No.: '''6050'''<br />
Line 29:		Line 29:
	Revised Date: '''06/30/14'''<br />		Revised Date: '''06/30/14'''<br />
	Reviewed Date: '''06/30/14'''<br />		Reviewed Date: '''06/30/14'''<br />
	~~<br />~~
	~~<br />~~
	'''<big>Bank Card Processing Policy</big>'''		'''<big>Bank Card Processing Policy</big>'''
	== Basis for Policy ==		== Basis for Policy ==

Afaylor: /* Technical Controls */

2015-05-07T16:05:04Z

Technical Controls

← Older revision		Revision as of 11:05, May 7, 2015
Line 53:		Line 53:
	All bank card transactions will be reviewed periodically and confirmed annually to assist in maintaining proper accountability and internal control. In addition, written departmental bank card procedures will be reviewed for conformity with UNMC policies, State Treasurer regulations, and Payment Card Industry Data Security Standards.		All bank card transactions will be reviewed periodically and confirmed annually to assist in maintaining proper accountability and internal control. In addition, written departmental bank card procedures will be reviewed for conformity with UNMC policies, State Treasurer regulations, and Payment Card Industry Data Security Standards.
	==Technical Controls==		==Technical Controls==
	All bank card transactions will be processed in conformance with the Payment Card Industry Data Security Standards. A secure network environment is established for processing of bank card transactions. A ~~vulnerabilty~~ management program is in place to ensure that the technical controls are functioning properly. Technical controls are in place to ensure that identity and access management is limited to those with a need to access the data in order to perform their job duties. Appropriate audit logging is enabled in order to track and monitor access. In the case of an information security event is found (such as an unauthorized wireless access point), the organization will follow the Incident Response Security Procedure. All members of UNMC complete annual information security compliance training.<br />		All bank card transactions will be processed in conformance with the Payment Card Industry Data Security Standards. A secure network environment is established for processing of bank card transactions. A vulnerability management program is in place to ensure that the technical controls are functioning properly. Technical controls are in place to ensure that identity and access management is limited to those with a need to access the data in order to perform their job duties. Appropriate audit logging is enabled in order to track and monitor access. In the case of an information security event is found (such as an unauthorized wireless access point), the organization will follow the Incident Response Security Procedure. All members of UNMC complete annual information security compliance training.<br />
	<br />		<br />
	For more detailed information, see the [[Bank Card Handling Procedures]] or contact the [mailto:wlawlor@unmc.edu Controller].<br />		For more detailed information, see the [[Bank Card Handling Procedures]] or contact the [mailto:wlawlor@unmc.edu Controller].<br />
	<br />		<br />
	This page maintained by [mailto:dpanowic@unmc.edu dkp].		This page maintained by [mailto:dpanowic@unmc.edu dkp].

Dpanowic: Created page with "

2014-06-30T20:02:54Z

Created page with "<table style="background:#F8FCFF; text-align:center" width="100%" cellspacing="0" cellpadding="0" border="0"> <tr> <td style="padding:0.5em; background-color:#e5e5e5; font-siz..."

New page
<table style="background:#F8FCFF; text-align:center" width="100%" cellspacing="0" cellpadding="0" border="0">
<tr>
<td style="padding:0.5em; background-color:#e5e5e5; font-size:90%; line-height:0.95em; border:1px solid #A3B1BF; border-bottom:solid 2px #A3B1BF"
width="20">[[Human Resources]]</td>
<td style="border-bottom:2px solid #A3B1BF" width="3"> </td>
<td style="padding:0.5em; background-color:#e5e5e5; font-size:90%; line-height:0.95em; border:1px solid #A3B1BF; border-bottom:solid 2px #A3B1BF"
width="20">[[Safety/Security]] </td>
<td style="border-bottom:2px solid #A3B1BF" width="3"> </td>
<td style="padding:0.5em; background-color:#e5e5e5; font-size:90%; line-height:0.95em; border:1px solid #A3B1BF; border-bottom:solid 2px #A3B1BF"
width="20">[[Research Compliance]] </td>
<td style="border-bottom:2px solid #A3B1BF" width="3"> </td>
<td style="padding:0.5em; background-color:#e5e5e5; font-size:90%; line-height:0.95em; border:1px solid #A3B1BF; border-bottom:solid 2px #A3B1BF"
width="20">[[Compliance]]</td>
<td style="border-bottom:2px solid #A3B1BF" width="3"> </td>
<td style="padding:0.5em; background-color:#e5e5e5; font-size:90%; line-height:0.95em; border:1px solid #A3B1BF; border-bottom:solid 2px #A3B1BF"
width="20">[[Privacy/Information Security]]</td>
<td style="border-bottom:2px solid #A3B1BF" width="3"> </td>
<td style="padding:0.5em; background-color:white; line-height:0.95em; border:solid 2px #A3B1BF; border-bottom:0; font-weight:bold;" width="20">[[Business Operations]]</td>
<td style="border-bottom:2px solid #A3B1BF" width="3"> </td>
<td style="padding:0.5em; background-color:#e5e5e5; font-size:90%; line-height:0.95em; border:1px solid #A3B1BF; border-bottom:solid 2px #A3B1BF"
width="20">[[Intellectual Property]]</td>
</tr>
</table>
 
[[General Accounting]] | [[SBIR/STTR Program Participation]] | [[Supplemental Compensation Plan]] | [[Facilities Management/Planning]] | [[Purchasing]] | [[Public Affairs]] | [[Facility Identification]] | [[Serving Alcoholic Beverages]] | [[Travel and Reimbursement]] | [[State Vehicles]] | [[Reproducing Copyrighted Materials]] | [[Bank Card Processing]] | [[Student Training Agreement]] | [[Volunteer]] | [[Cash Handling]] | [[Fraud]] | [[Assigning Research Lab Space]] | [[Space Scheduling]] | [[International Health Education]] | [[Faculty Personnel Records]] | [[Cellular Phone]] | [[Off-campus Graphic Design and Related Printing]] | [[Off-campus Photography]] | [[Tax Exempt Financing and Tracking of Both Qualified Use and Non-Qualified Use of Research Space]] | [[Secondary Logos]] | [[Social Media]]
 
Policy No.: '''6050''' 
Effective Date: '''01/10/07''' 
Revised Date: '''06/30/14''' 
Reviewed Date: '''06/30/14''' 
 
 
'''<big>Bank Card Processing Policy</big>'''
== Basis for Policy ==
It is the policy of the University of Nebraska Medical Center (UNMC) to establish good internal controls over the handling of bank card transactions to adequately safeguard and properly record UNMC assets and to protect the employees who handle those assets. Further, it is the policy of UNMC to comply with all [http://www.nebraskalegislature.gov/laws/laws.php state regulations] and the Payment Card Industry Data Security Standards (PCI/DSS).
==Definitions==
Bank card is defined as credit cards, debit cards, ATM cards and any other card or device, other than cash or checks, issued by a bank or credit union that is normally presented by a person seeking to make payment. The process of paying is considered as the transaction. 
 
Payment Card Industry Data Security Standards (PCI/DSS) are guidance for organizations to assist in providing data security on payment card transactions.
== Authority Over Bank Card Transactions ==
It is the policy of the University of Nebraska Medical Center that all bank card transactions on the UNMC campus will be under the control of the Controller. Web-based bank card transactions must utilize the standard UNMC application provided by Information Technology Services.
==Bank Card Reporting ==
Bank card collections received by departments for UNMC will be submitted along with cash/check collections and a Cash Remittance Report to the [http://info.unmc.edu/cashering.htm Finance Cashier].
== Internal Controls ==
*Departments will maintain written detailed internal procedures describing the proper handling of bank card transactions. These internal procedures must address the following, at a minimum;
The bank card swipe terminal must be located in a position that prohibits direct physical interaction from unauthorized individuals.
Periodically inspect terminal surfaces to detect tampering (for example, addition of card skimmers to devices), or substitution (for example, by checking the serial number or other device characteristics to verify it has not been swapped with a fraudulent device).
**Personnel involved with bank card transactions must document knowledge of their awareness to attempted tampering or replacement of devices by completing the UNMC PCI 3.0 Point of Sale training material, which will be retained by the Finance Cashier.
Under no circumstances should bank card information be stored on any computer system. This includes, but is not limited to: emails, documents, spreadsheets and databases.
UNMC outsources e-commerce bank card processing. UNMC ITS Application Services has a module which is utilized to bridge the web application which accepts a bank card payment and the card processing company.
**All bank card transactions processed by UNMC Staff, on behalf of the customer, must go through the bank card terminals provided by the Finance Cashier. Under no circumstances, shall a UNMC Staff member enter a bank card number into a UNMC Web Application on behalf of the cardholder.
== Auditing Cash Funds ==
All bank card transactions will be reviewed periodically and confirmed annually to assist in maintaining proper accountability and internal control. In addition, written departmental bank card procedures will be reviewed for conformity with UNMC policies, State Treasurer regulations, and Payment Card Industry Data Security Standards.
==Technical Controls==
All bank card transactions will be processed in conformance with the Payment Card Industry Data Security Standards. A secure network environment is established for processing of bank card transactions. A vulnerabilty management program is in place to ensure that the technical controls are functioning properly. Technical controls are in place to ensure that identity and access management is limited to those with a need to access the data in order to perform their job duties. Appropriate audit logging is enabled in order to track and monitor access. In the case of an information security event is found (such as an unauthorized wireless access point), the organization will follow the Incident Response Security Procedure. All members of UNMC complete annual information security compliance training. 
 
For more detailed information, see the [[Bank Card Handling Procedures]] or contact the [mailto:wlawlor@unmc.edu Controller]. 
 
This page maintained by [mailto:dpanowic@unmc.edu dkp].