The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard for organizations that store, process or transmit cardholder data (CHD) in any format (e.g. electronic, paperbased, etc). This standard was created to better assist entities increase overall security of CHD and reduce credit card fraud via its exposure. The PCI DSS is comprised of 12 requirements that specify the framework for secure payment environments.
Longwood University will undertake steps to ensure the University is compliant with the PCI DSS by developing and implementing a service offering that includes the technology, training, policies, procedures, processes and support to achieve compliance and mitigate risks, as outlined in the PCI DSS
Compliance Roadmap Report.
The PCI Project Team is a cross-organizational working group of representatives from the University that have interaction with the handling of CHD. This team will discuss findings and develop strategies that will ensure PCI DSS requirements are met.
The PCI Project Team will assist the University in getting compliant with the PCI DSS and reduce the scope of items that will need to be compliant with the PCI DSS by implementing the changes set forth by the strategic direction of the University.

Meet monthly to address issues and findings.

Develop strategies for remediation of non-compliant items.

Monitor, support and follow up with merchant areas to ensure any and all corrective actions are applied.

Report any feedback, concerns and proposals from the merchant areas to the project team.

Assist merchants in completing their annual Self-Assessment Questionnaires (SAQ).

Champion PCI DSS compliance across the University.

Edward Ko, Security Advisor – CampusGuard

Cat Mobley, Director of Financial Operations & Materiel Management (Chair)

Tracy Nelson, Financial Operations – Special Projects

Bob Smith, Information Security Officer

Bruce Jenkins, Director - Cashiering & Student Accounts

Crissy Sampier, LancerCard Office Manager

Aneicia Stimpson, Director of Application Services

David Overstreet, Internal Auditor (non-voting member)

The PCI Project Team will meet at least monthly to discuss and act upon areas of non-compliance at the
University. The direction will be based on a consensus, incorporating the requirement to be compliant with the PCI DSS. If consensus cannot be reached, the Chair will seek resolution with the PCI DSS
Compliance Project Sponsor (Vice President for Administration and Finance).
The PCI Project Team will remain in place for the duration of the PCI DSS Compliance Project.