|
|||||||
|
|
Frequently Asked Questions about PCI Compliance
How does PCI affect specific Blackbaud products?
Who regulates these standards? The Payment Card Industry Data Security Standards are a set of requirements instituted and regulated by the https://www.pcisecuritystandards.org/. The PCI SSC is a consortium of major card brands including VISA, MasterCard, AMEX, DiscoverCard and JCB, created to enhance credit and debit card data security. All organizations that process, store, or transmit payment card data must comply with PCI DSS requirements or risk losing their ability to process credit card payments. The council also supports Payment Application (PA) security standards for software products that are installed and used locally by merchants to process, store or transmit credit card data. Software products that meet PA DSS standards have been validated as compliant with PCI DSS requirements and enable merchants to readily attain PCI compliance. I’ve heard a lot of dates associated with PCI. What are the “real” ones? Visa has been the principle driver in setting these compliance dates. Here are the dates from Visa:
 What do I have to do? It is the responsibility of each organization to comply with the PCI DSS by the dates prescribed by the PCI Security Council or by your acquiring bank. Blackbaud can help you comply by providing applications and solutions that meet these standards. You should review the standards provided by the security council and assess your PCI requirements
What are the merchant levels? Visa and the other card brands distinguish “merchants” by levels depending on the number of transactions transmitted on an annual basis.
** A merchant meeting Level 1 criteria in any Visa country/region that operates in more than one country/region is considered a global Level 1 merchant. Exceptions may apply to global merchants if no common infrastructure exists or if Visa data is not aggregated across borders; in such cases the merchant validates according to regional levels. Are these PCI regulations laws? PCI DSS are a set of regulations developed by the PCI Security Council and the card brands. One of the goals is to achieve self-regulation and to avoid legal jurisprudence. There are, however a number of states that have implemented laws associated with data security that includes credit card security. What has Blackbaud done to become PCI compliant? One - Blackbaud has modified every application that processes, stores, transmits credit card numbers to become PCIDSS and PADSS compliant. We have implemented PCI standards regarding secure storage of data, strong access control, and other requirements. The list of affected products includes:
The Blackbaud Payment Service (BBPS), a secure vaulting and tokening service to make being PCI compliant easier for our customers. Three - Blackbaud has upgraded our entire OnDemand hosting environment to ensure PCI DSS compliance and data security. Four - Blackbaud has passed all audits conducted by our 3rd-party Qualified Security Assessor, Trustwave. Five - For existing Blackbaud customers, we have created Knowledge Base solutions to explain in detail the changes to each of the applications. We have also included Implementation Guides for the applications that have completed their audit process, system requirements and upgrade procedures.. The Blackbaud Payment Service (BBPS) What is the Blackbaud Payment Service (BBPS)?In order to make The Raiser's Edge, NetSolutions, Blackbaud NetCommunity, and Blackbaud Enterprise CRM compliant with PCI DSS and PA DSS, we have developed the Blackbaud Payment Service (BBPS). BBPS integrates with the PA DSS compliant versions of our software and stores credit card and merchant account information in a secure environment. Credit card numbers will no longer be visible in our software and will be replaced with reference tokens. When you process credit card transactions, the reference token in your database will summon the stored credit card number from BBPS to be used in the transaction. Download the BBPS Overview for or more information How does the BBPS work? When you migrate to the next version of The Raiser’s Edge, Blackbaud NetCommunity and Blackbaud CRM, you will connect to the BBPS which will scan your Raiser’s Edge or CRM database for credit card numbers and upload them to the service. BBPS will communicate to your credit card processor, validate your credit cards and return a unique token to your database that will always reference that credit card. Users will see this token as the last four digits of the credit card number. What credit card processor is supported by BBPS? BBPS supports many processors. Additionally, Blackbaud has partnered with several payment processors to provide multiple options for payment processing. Are there any additional charges for the PA DSS versions of these applications? No. These are considered regular upgrades and are covered in your maintenance contract. Can we use the token to add new donations or do we need to get the credit card again? You do not need to get a credit card number again from the donor once the original number has been saved and tokenized. The token is stored in your database and will appear to users as a truncated credit card number. You just reference the token and the new donations are attributed to the credit card. If I use these new versions of Blackbaud software will I be PCI compliant? Using PA DSS Blackbaud’s certified applications will help you become PCI compliant by no longer storing credit card information in the databases, but you will still need to assess if your organization and network complies with PCI DSS requirements. However, each organization is responsible for validating their compliancy with the PCI standards. We suggest you review the self-assessment at the PCI Security Council’s website. If we are not using The Raiser’s Edge and use a 3rd party vendor to process our credit cards, how do we know if they are PCI compliant? You should contact your vendor and request a copy of their Report on Compliance (ROC) and ask who did the assessment. You may want to contact the assessing body for additional information. The Raiser's Edge What changes are being made to The Raiser's Edge? If you choose not to use BBPS, back up your credit card data before updating to the PA DSS version of our software as all credit card information will be removed. Contact a Qualified Security Assessor for advice on how to secure this credit card information in accordance with PCI DSS. Blackbaud has a partnership with Trustwave to provide discounted PCI services to our customers. Altru The Payment Card Industry Data Security Standards (PCI DSS) and Payment Application Data Security Standards (PA DSS) were created by the Payment Card Industry Security Standards Council to help facilitate the broad adoption of consistent payment card data security measures on a global basis. In order to meet the requirements as defined in these standards, we have opted to remove credit card and merchant account data from all applications that process, store, or transmit payment card data. If you are a customer who processes credit card transactions within Altru, upon upgrade to version 2.0, full credit card numbers will no longer be visible in the product and will be replaced with reference tokens; users will see these token as the last four digits of the credit card number. When you process credit card transactions, the reference token in your database will summon the full credit card number that will be stored in BBPS to be used in the transaction. You will be able to continue to process credit card transactions as you do today and no other functionality is affected by the change. Blackbaud CRM The Payment Card Industry Data Security Standards (PCI DSS) and Payment Application Data Security Standards (PA DSS) were created by the Payment Card Industry Security Standards Council to help facilitate the broad adoption of consistent payment card data security measures on a global basis. In order to meet the requirements as defined in these standards, we have opted to remove credit card and merchant account data from all applications that process, store, or transmit payment card data. If you are a customer who processes credit card transactions within Blackbaud CRM, upon upgrade to version 2.0, full credit card numbers will no longer be visible in the product and will be replaced with reference tokens; users will see these token as the last four digits of the credit card number. When you process credit card transactions, the reference token in your database will summon the full credit card number that will be stored in BBPS to be used in the transaction. You will be able to continue to process credit card transactions as you do today and no other functionality is affected by the change. The Patron Edge The Payment Application Data Security Standards (PA DSS) were created by the Payment Card Industry Security Standards Council to help software vendors develop secure payment applications in compliance with PCI DSS. To make our software PA DSS compliant, we have opted to remove credit card and merchant account data from all applications that process, store, or transmit payment card data. Beginning in The Patron Edge version 3.34 and Patron Edge Online version 3.35, credit card information will be encrypted prior to clearing transactions. After the transactions are cleared, all but the last four digits of the credit card number will be deleted from the database. During the update to The Patron Edge 3.34 and Patron Edge Online 3.35, a new encryption utility will locate all credit card numbers stored in the database and mask them, retaining only the last four digits. Will I need to update Microsoft SQL Server? Will I have backwards compatibility? Do The Patron Edge or The Patron Edge Online integrate with the Blackbaud Payment Service? NetSolutions What changes are being made to NetSolutions? When a donation is made through NetSolutions, the credit card information is verified by your credit card processor and stored in BBPS. Credit card numbers will no longer be downloaded to The Raiser's Edge and will be replaced with reference tokens; users will see these token as the last four digits of the credit card number. Will this affect recurring gifts? Will I need to update The Raiser's Edge? Note: If your organization only accepts one-time credit card donations from NetSolutions, this update is not mandatory. However, you will not be able to download any credit card information. You will need to contact either your credit card processor or the donor to get this information. The Financial Edge, Blackbaud Student Information System, The Education Edge The Payment Application Data Security Standards (PA DSS) were created by the Payment Card Industry Security Standards Council to help software vendors develop secure payment applications in compliance with PCI DSS. To make our software PA DSS compliant, we have opted to remove credit card and merchant account data from all applications that process, store, or transmit payment card data. What changes are being made to Blackbaud Student Information System, The Education Edge, and The Financial Edge? Blackbaud NetCommunity The Payment Application Data Security Standards (PA DSS) were created by the Payment Card Industry Security Standards Council to help software vendors develop secure payment applications in compliance with PCI DSS. To make our software PA DSS compliant, we have opted to remove credit card and merchant account data from all applications that process, store, or transmit payment card data. What changes are being made to Blackbaud NetCommunity? How does the integration with BBPS work? When will the PA DSS version of Blackbaud NetCommunity become generally available?
eTapestry All eTapestry services are fully PCI compliant. PCI compliance is a set of security requirements endorsed by the PCI Security Standards Council, founded by a consortium of major credit card brands to enhance credit and debit card data security. The consortium includes Visa Inc., MasterCard Worldwide, American Express, Discover Financial Services and JCB. All organizations that process, store, or transmit payment card data must comply with PCI standards. All existing merchant organizations must comply with PCI standards or risk losing their ability to process credit card payments.
|
Call
Our award-winning support team & sales representatives are standing by to help!
Chat
Chat with our experienced staff to receive immediate help right away!
Connect
Subscribe to our feeds, friend us on facebook, follow us on twitter and YouTube
click to connect
Privacy Policy | Disclaimer | Safe Harbor Notice | Terms of Use | Acceptable Use Policy | Sitemap | © 2011 Blackbaud, Inc. All Rights Reserved