Data security policy - Revision history

MichaelWestwind: /* Credit cards */

2011-01-22T01:49:59Z

Credit cards

MichaelWestwind: /* Sensitive data */

2011-01-22T01:21:18Z

Sensitive data

MichaelWestwind: /* Credit cards */

2011-01-22T01:17:00Z

Credit cards

MichaelWestwind: /* Training */

2010-12-18T01:09:25Z

Training

MichaelWestwind: /* Security Oversight */

2010-10-15T21:45:39Z

Security Oversight

MichaelWestwind: /* Sensitive data */

2010-09-29T23:57:14Z

Sensitive data

MichaelWestwind at 23:51, 29 September 2010

2010-09-29T23:51:16Z

MichaelWestwind at 23:47, 29 September 2010

2010-09-29T23:47:57Z

MichaelWestwind: /* Training */

2010-09-29T22:51:20Z

Training

MichaelWestwind at 22:49, 29 September 2010

2010-09-29T22:49:39Z

@@ Line 36: / Line 36: @@
 * In those few instances where cardholder data is retained, such as from a mailing, or a "kerchunked" sales slip, it must be kept in a specially marked container in the safe.
 * When media containing cardholder data is no longer needed for a business purpose it should be physically destroyed or securely wiped, once a quarter, media containing cardholder data older than '''4''' months should be destroyed.
 * Credit card data must never leave the premises by any means, paper or electronic, including thumb drives, pdas or laptop, without express approval from the Technocrats committee, by means the Technocrats consider to be secure.
 === Outside service providers ===

← Older revision		Revision as of 01:21, 22 January 2011
Line 41:		Line 41:

	* If any outside service providers are engaged to handle any part of the credit card system (e.g. a web commerce page), that organization must first be approved by the Technocrats after verifying that they are able to handle the data securely, and only through a formal contract agreement which takes PCI compliance issues into account.		* If any outside service providers are engaged to handle any part of the credit card system (e.g. a web commerce page), that organization must first be approved by the Technocrats after verifying that they are able to handle the data securely, and only through a formal contract agreement which takes PCI compliance issues into account.
		+
		+	=== Contractors ===
		+	* Contractors and any other persons authorized to handle any credit card data must be made aware of the need for proper data security and the need to follow procedures set up by the technocrats to ensure data security.

	== Training ==		== Training ==

@@ Line 36: / Line 36: @@
 * In those few instances where cardholder data is retained, such as from a mailing, or a "kerchunked" sales slip, it must be kept in a specially marked container in the safe.
 * When media containing cardholder data is no longer needed for a business purpose it should be physically destroyed or securely wiped, once a quarter, media containing cardholder data older than '''4''' months should be destroyed.
-* Credit card data must never leave the premises by any means, paper or electronic, without express approval from the Technocrats committee, by means the Technocrats consider to be secure.
+* Credit card data must never leave the premises by any means, paper or electronic, including thumb drives, pdas or laptop, without express approval from the Technocrats committee, by means the Technocrats consider to be secure.
 === Outside service providers ===

@@ Line 43: / Line 43: @@
 == Training ==
-* Cashier training shall include credit card holder data security.  All staff, volunteers and contractors authorized to handle money are required to go through the cashier training.
+* Cashier training shall include credit card holder data security.  All staff, volunteers and contractors authorized to handle money are required to go through the cashier training annually.
 == Related documentation ==

@@ Line 11: / Line 11: @@
 == Security Oversight ==
 * Network and data security are overseen by the [[ASS|Admistrators of Systems and Security]] working group, who are overseen by the [[Technocrats]] staff committee.
-* Their duties cover any network or server problems, including security issues such as intrusions or abuse of the system.
+* Their duties cover any network or server problems, including security issues such as intrusions or abuse of the system and are responsible for ensuring that good security practices are defined and followed.
 == Network use ==

@@ Line 102: / Line 102: @@
 - Verify that information security policies clearly define information security responsibilities for both employees and contractors.
-.5 done
+.5 - done
@@ Line 114: / Line 114: @@
-.5.3
+.5.3 - done
@@ Line 127: / Line 127: @@
 - Verify that responsibility for creating and distributing security incident response and escalation procedures is formally assigned.
-.6
+.6 - done as long as we continue to have regular cashier training.
@@ Line 140: / Line 140: @@
-.8
+.8 - not currently happening
@@ Line 151: / Line 151: @@
 - If the entity being assessed shares cardholder data with service providers (for example, back-up tape storage facilities, managed service providers such as Web hosting companies or security service providers, or those that receive data for fraud modeling purposes), through observation, review of policies and procedures, and review of supporting documentation.
-.8.1
+.8.1 - not currently happening

← Older revision		Revision as of 23:47, 29 September 2010
Line 102:		Line 102:
	- Verify that information security policies clearly define information security responsibilities for both employees and contractors.		- Verify that information security policies clearly define information security responsibilities for both employees and contractors.

−	12.5	+	12.5 done

@@ Line 2: / Line 2: @@
 ;This is policy in progress.  It is a necessary part of PCI Compliance, which applies to cardholder data (basically credit card numbers and associated personal info) though we should probably make it more general and apply it to all sensitive data.
 ==Scope==
 * This policy applies to the creation, protection and destruction of sensitive data and should be known by all employees, volunteers or contractors who are entrusted with access to said data.
 == Annual Review ==
@@ Line 14: / Line 14: @@
 == Network use ==
 === Wireless ===
 * A wireless access point is provided for general public use.  This wireless access is firewalled in such a way as to have access to the internet, but not to any part of the internal network.  Other than agreeing to the usage terms, there is no restriction on access to this wireless system, but abusers of the system, such as torrenters, will be detected and blocked.  No other wireless access point is to be attached to our network without express approval and oversight from the Technocrats committee or Administrators of Systems and Security working group.
@@ Line 24: / Line 25: @@
 === Internal Network ===
-* Other services, such as the application servers and database, are accesible only from within Free Geek.
+* Other services, such as the application servers and database, are accesible only from within Free Geek.  Staff and volunteers have access to the application servers.  Access to the contributor database is limited to approved staff and volunteers.  No credit card data is to be stored on the application servers or in the database.
 == Sensitive data ==
 === Credit cards ===
 * Credit cards are normally processed only through the special credit card machines at the front desk and the store and so credit cardholder data is not normally stored onsite.
 * In those few instances where cardholder data is retained, such as from a mailing, or a "kerchunked" sales slip, it must be kept in a specially marked container in the safe.
@@ Line 47: / Line 52: @@
-.1
+.1 - done
@@ Line 61: / Line 66: @@
-.1.3
+.1.3 - done
 ''
@@ Line 73: / Line 78: @@
 ''
 .3.a