Skip to main content

WSU Policies and Procedures

13.14 / Security of Payment Card Data

Effective
Jan. 22, 2009
Last revised
Feb. 24, 2026

  1. Initiating Authority

    1. The Senior Associate Vice President, Financial Services serves as the initiating authority for this policy.

  2. Purpose

    1. The purpose of this statement is to set forth University policy in compliance with the Payment Card Industry (PCI) Data Security Standards (DSS).
    2. The primary objective of PCI DSS is to protect payment cardholder data. Compliance with PCI DSS is required of all organizations that process, store or transmit cardholder data. The University's failure to comply with PCI DSS standards could result in severe consequences to the University, including the imposition of fines by the affected card brands, legal costs, fraud losses, and termination of the ability to accept Payment Cards.

  3. Policy

    1. The Senior Associate Vice President, Financial Services, or his or her designee, shall approve each request to accept Payment Cards, perform reviews to ensure compliance, monitor the use of Payment Card transactions for compliance with University policies and contracts with financial institutions and third-party vendors, and oversee Payment Card accounting.
    2. All transactions that involve the transfer of Payment Card data must be performed on systems provided or approved by the University for this purpose. Payment applications used to process Payment Cards must be compliant with the PCI Security Standards Council's Payment Application Data Security Standard (PA-DSS). This includes payment applications hosted off campus by third parties as well as those hosted on campus.
    3. Financial Services (FOBT) will maintain an inventory of all technologies used to process Payment Cards that are in scope for PCI DSS. Only FOBT-approved devices and software may be used.
    4. Unless expressly permitted in this policy, no card numbers or any documentation containing card numbers or cardholder data shall be transmitted or stored in any personal computer, email account or any other form of electronic media. This restriction applies to multi-use virtual cards issued by any brand or to single-use virtual cards issued for Discover, JCB, or American Express (AMEX).
    5. Single-use virtual card numbers issued for Visa and Mastercard transactions may be transmitted electronically for payments to or from an outside organization.
    6. No paper documents, including but not limited to, paper receipts and hand-written notes, containing card numbers or cardholder data shall be permanently stored by an approved department or unit. Said documents must be destroyed within two days of processing.
    7. The Chief Information Officer and Chief Information Security Officer or his or her designee shall provide advice/how-to/tools to enable departments and units to clearly follow industry best practices for access, firewalls, patches, data storage, passwords, encryption and security.
    8. All suspected security breaches shall be reported to the Chief Information Officer and Chief Information Security Officer immediately. The Chief Information Officer and Chief Information Security Officer shall investigate suspected security breaches and coordinate the University's response with the appropriate parties as needed and appropriate.
    9. Individuals in violation of this policy are subject to the full range of sanctions, including, but not limited to, the loss of computing or network access privileges; disciplinary action, including suspension and termination from employment for employees and dismissal from the University for students; and possible legal action. Some violations may constitute criminal offenses under local, state and/or federal law and the University will carry out its responsibility to report such possible violations to the appropriate authorities.

  4. Definitions

    For the purpose of this policy only, the following definitions shall apply:

    1. Payment Card: A Payment Card is part of a payment system issued by financial institutions, such as a bank, to a customer that enables the customer to access the funds in the customer's designated bank accounts or through a credit account. Such cards are known by a variety of names including bank cards, ATM cards, money access cards, client cards, cash cards and credit cards.

  5. Applicable Laws And Additional Resources

    1. WSU Policy 20.18 / Privacy of Financial Information

  6. Revision Dates

    1. July 30, 2009
    2. April 1, 2014
    3. June 3, 2016
    4. September 28, 2020
    5. July 22, 2025 (maintenance updates only)
    6. February 24, 2026
About this policy version

New or Existing Policy

This is a change to an existing policy.

Current Policy Title

13.14 / Security of Payment Card Data

Revised Policy Title

N/A

Last Revised Date of Policy

July 22, 2025 (maintenance)

Initiating Authority

Senior Associate Vice President, Financial Services

Summary of Policy or Policy Change

This policy is being updated to simplify business processes and reflect advances in payment technology that present very low risk in relation to data transfers, while improving compliance with Payment Card Industry (PCI) Data Security Standards. Minor updates were also made to conform to the University's standard policy format.

Specific changes include permitting electronic transmission of single-use virtual payment card numbers issued for Visa and Mastercard for payments to and from outside organizations.

Reason or Need for Policy

Payment technology has evolved in a manner that permits low risk electronic payments through single-use virtual payment cards from certain payment card providers (Visa and Mastercard). For some outside organizations, this is the only available method of payment. Updates to this policy are necessary to reflect these advances in payment technology, which will simplify business processes while improving compliance with Payment Card Industry (PCI) Data Security Standards.

Other Notes for Consideration

N/A

Date Policy Request to PET

February 24, 2026

©