Skip to main content
Sign in

MSA: PCI OMS Other Authorization

  • Updated

MSA: PCI OMS Other Authorization

  1. Select Yes, No, or NA for every question in the PCI OMS Other Authorization section.

  2. Type an explanation or action item in the Comment column, for any question that you responded No.

    Questions in red font will also appear on a corporate audit if your store is selected. A link to resources to support answering each question are available at the bottom of each question.

Tips and Tricks

QuestionsTips and Tricks

  1. Is the store properly handling credit card numbers, per PCI standards?

  • Review the Credit Card Acceptance policy.

  • Customer credit card numbers must be protected at all times. The store should not retain customer credit card numbers on documents in the store.

  1. Are application server(s) in a locked PCI cabinet secured with a keyed lock? *The server cabinet may only have a combination lock if the room in which the server cabinet is located is secured with a key lock or badge reader lock for entry into the room.

     

    Is a sign posted on the door of the rack with the server that states, "Door Must be Locked at All Times - Only Authorized Personnel Allowed?" Is the key for the server cabinet in a secure location? Is the server visitor log present and up to date?

  • Server cabinet should be locked at all times.

  • Lock should be keyed and secured in the safe. (If the server is in a locked room, the server may have a combination lock – the door to the room must have a key lock or badge reader).

  • Door Must be Locked At All Times sign must be posted on the server.

  • Server visitor log must be posted and up to date.

  1. Has the store reviewed and purged all prepaid/online orders for pickup within a maximum of 45 days from the start of classes or order date, whichever is later?

  • Purge abandoned orders no later than 45 days from the start of class.

  • Make 1 attempt to contact the customer. To remind them their order is ready for pickup.

  • Use this script, "Hello, my name is (insert name). I am contacting you from(insert bookstore name) regarding the order you placed with us. Please get in touch with us at(insert phone number), no later than(insert date 45 days after the first day of classes)."

  1. Is the tamper-proof tape installed on all MX915 PIN Pads (tape must not be damaged or peeled)? Has the store completed a monthly audit of each credit card terminal connected to the POS to detect signs of tampering?

  • Inspect every Pin pad in the store.

  • Does each pin pad have the tamper-proof tape. Ensure it is correctly placed and there is no evidence of tampering.

  • Complete monthly audit of all pin pads.

  1. Are RJ45 plugs installed in all the wall jacks, not in use?

  • All open network jacks must have locking devices.

  1. All passwords must be treated as sensitive and confidential - no sharing of passwords and not written passwords in a readily decipherable form. Is the store adhering to/meeting PCI standards as it relates to password usage?

  • All passwords are sensitive and confidential.

  • Passwords should not be written in places accessible to others

  • Other team members should not use your credentials to access store systems.

  1. Have all terminated team members been locally removed from CORE POS, Course Tracks, and if applicable, has a SAR been submitted to remove SODA access?

  • All terminated team members' should have their access to all systems removed.

    Ex: CourseTracks and COREPOS

  1. Are terminal pin pads mounted and properly secured cradles or with tethers?

  • Ensure all pin pads in the store are either bolted to a counter or tethered to the CPU.

  1. No non-Follett external devices can be connected to Follett computers (USB, phones, tablets, etc.). Is the store compliant?

  • Do not connect non-Follett external devices to Follett computers.

  1. Have all new hires completed the Information Security Awareness training within 90 days of employment?

  • Review team members' training to ensure completion.

Articles in this section

See more