All Northwestern University departments that accept credit/debit card payments are considered merchant locations and must process those payments in a secure manner. It is the responsibility of each merchant location to maintain compliance with the NU Merchant Card Policy and the Payment Card Industry Data Security Standard (PCI DSS) established by the Payment Card Industry Security Standards Council (PCI SSC).
Treasury Services is a central e-commerce administrator and compliance resource for Northwestern University merchant locations. All Northwestern University merchant locations must participate in Northwestern University’s PCI training program and compliance initiatives. Failure to fully participate may result in the merchant account being revoked.
Core Compliance Requirements
Northwestern’s PCI DSS Compliance Program addresses requirements of the PCI SSC, including:
Security Awareness Education (required PCI DSS Security Training and Attestation)
Third Party Service Provider (TPSP) engagement
System Vulnerability Scans
System Penetration Testing
Periodic Reviews and Audits
Annual PCI SAQ (Self-Assessment Questionnaire)
Detailed Compliance Pillars & Requirements
Per PCI DSS requirement 12.6, Northwestern University requires all Northwestern merchant location personnel interacting with the Cardholder Data Environment (CDE) in any manner (from the initial entry to the final reconciliation) to complete an annual training and attestation. This mandatory requirement includes student employees, contractors and volunteers.
Compliance Warning: Individuals who have not completed training and attestation are not permitted to process Cardholder Data (CHD) on behalf of Northwestern University interests. Merchant locations using untrained or unattested individuals to process CHD may have their merchant account revoked.
Treasury Services may require individual or group participation in additional PCI security awareness education training as needed.
NU Merchant locations or their representatives, including vendors and other TPSPs, may not enter into legally binding agreements with TPSPs processing or handling any type of CHD (Cardholder Data), or interacting in any other way with the CDE (Cardholder Data Environment) without proper NU vetting and approval first; including but not limited to Treasury Services, NU IT Security and Compliance, NU Office of General Counsel and NU Purchasing. All agreements with TPSPs must have specific PCI DSS and liability shift language included.
Merchants with non-P2PE, on-campus payment systems connected to the Internet are required to run vulnerability scans against their systems. Northwestern University’s contract with Trustwave includes external vulnerability scans that are scheduled on the TrustKeeper Portal; scan reports are posted on the TrustKeeper Portal as well. It is the responsibility of the Merchant to review the scans and address any vulnerabilities that have been identified. Failure to address identified vulnerabilities can result in the Merchant location, as well as the entire University, falling out of compliance. Merchants with PCI-validated P2PE payment systems are not required to run scans.
Northwestern University is now a PCI Level 3 Merchant based upon recent card processing metrics, and NU Merchants with non-P2PE, on-campus payment systems connected to the Internet are now required to have internally conducted penetration testing performed at least quarterly. Since this service is not currently a part of our Trustwave contract, arrangements need to be made by e-Commerce Operations and NU IT Security and Compliance, coordinated with Merchant onsite Administrators and IT staff. Failure to cooperate with this mandatory requirement may result in your Merchant account being revoked. Merchants with PCI-validated P2PE payment systems are not required to run penetration tests.
Treasury Services and Northwestern’s PCI DSS partners or consultants may perform periodic reviews or audits of merchant location operations to ensure that merchants comply with PCI DSS and the University's risk is reduced. Failure to cooperate with such activities may result in merchant account usage being revoked.
Merchant locations should also routinely review their procedures and equipment, including physically inspecting card processing equipment to ensure devices have not been substituted or tampered. This Merchant Location Device Inspection Log can be used for your inspections.
All Northwestern University merchant locations are required to validate PCI-DSS compliance at least annually by completing the appropriate SAQ in a timely manner. A questionnaire must be completed for each Merchant account, and a new questionnaire must be filled out whenever any of the following have occurred:
payment processing system changes
a year has elapsed since your last SAQ
upon Treasury Services request
The SAQ should be completed through the TrustKeeper Portal which is available in the CardConnect CardPointe gateway.
There are 8 types of SAQ. Treasury Services or Arrow Payments can help determine which type is required for your merchant location environment (see next section).
SAQ Types & Payment System Reference Table
SAQ Type
Type of Payment System
SAQ A
Card-not-present merchants (e-commerce or mail/telephone-order) that have fully outsourced all cardholder data functions to PCI DSS compliant third-party service providers, with no electronic storage, processing, or transmission of any cardholder data on the merchant’s systems or premises. Not applicable to face-to-face channels.
SAQ A-EP
Card Not Present, E-commerce merchants who outsource all payment processing to PCI DSS validated third parties, and who have a website(s) that doesn’t directly receive cardholder data but that can impact the security of the payment transaction. No electronic storage, processing, or transmission of any cardholder data on the merchant’s systems or premises. Applicable only to e-commerce channels
SAQ B
Merchants using only Imprint machines with no electronic cardholder data storage and/or Standalone, dial-out terminals with no electronic cardholder data storage. Not applicable to e-commerce channels.
SAQ B-IP
Merchants using only standalone, PTS-approved payment terminals with an IP connection to the payment processor, with no electronic cardholder data storage. Not applicable to e-commerce channels.
SAQ C
Merchants with payment application systems connected to the Internet, no electronic cardholder data storage. Not applicable to e-commerce channels.
SAQ C-VT
Merchants who manually enter a single transaction at a time via a keyboard into an Internet-based Virtual Terminal solution that is provided and hosted by a PCI DSS validated third-party service provider. No electronic cardholder data storage. Not applicable to e-commerce channels.
SAQ D
All other SAQ-Eligible Merchants
SAQ P2PE-HW
Merchants using only hardware payment terminals that are included in and managed via a validated, PCI SSC-listed P2PE solution, with no electronic cardholder data storage. Not applicable to e-commerce channels.
Northwestern Merchant locations or their representatives, including vendors and other TPSPs, may not enter into legally binding agreements with TPSPs processing or handling any type of CHD (Cardholder Data), or interacting in any other way with the CDE (Cardholder Data Environment), without the proper layers of University vetting and approval first; this would include but not be limited to e-Commerce, Treasury Services, Northwestern IT Security and Compliance, Northwestern Office of General Counsel, and Northwestern Procurement and Payment Services. ALL agreements with TPSPs must have specific PCI DSS and liability shift language included.
In addition, requests to enter into agreements with TPSPs must be initiated within the the Merchant Card Processing Request and supported by a strong business case, diagrammatic overview of the TPSPs application and network architecture which supports and secures all interaction with the CHD and CDE, verifiable evidence of the TPSPs PCI DSS Compliance and Validation, and other items based upon the scope of the proposed implementation. This information is to be supplied by the Merchant in the completed e-Commerce Addendum which is part of the Merchant Card Processing Request.
Please refer back to the e-Commerce homepage for an overview of this process, and please refer to PCI DSS 3.2 Third Party Security Assurance (below) for explicit guidelines and evaluation matrices which will help the Merchant, in conjunction with e-Commerce and other key teams, evaluate the suitability of the desired TPSP BEFORE commitments are made and an agreement is signed.
TPSP (Third Party Service Provider)
As defined in the PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms, a service provider is a business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This also includes companies that provide services that control or could impact the security of cardholder data. There are many types of businesses that could fall into the category of "service provider", dependent on the services provided.
Nested or Chained TPSP
As defined in the PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms, a nested or chained TPSP is any entity that is contracted for its services by another third-party service provider for the purposes of providing a service.
Merchants with on-campus payment systems connected to the Internet are required to run vulnerability scans against their systems. Our contract with Trustwave includes external vulnerability scans that are scheduled on the TrustKeeper Portal; scan reports are posted on the TrustKeeper Portal as well. It is the responsibility of the Merchant to review the scans and address any vulnerabilities that have been identified. Failure to address identified vulnerabilities can result in the Merchant location, as well as the entire University, falling out of compliance.
Northwestern is now a PCI Level 3 Merchant based upon recent card processing metrics, and Northwestern Merchants with on-campus payment systems connected to the Internet are now required to have internally conducted penetration testing performed at least quarterly. Since this service is not currently part of our Trustwave contract, arrangements need to be made by e-Commerce Operations and Northwestern IT Security and Compliance, coordinated with Merchant onsite Administrators and IT staff. Failure to cooperate with this mandatory requirement may result in your Merchant account being revoked. Please contact e-Commerce Operations at ccard@northwestern.edu or 847-467-4962 for more information for more information.
e-Commerce Operations will regularly review the completed SAQs and vulnerability scans on the Merchant's TrustKeeper Portal, along with internal Penetration Tests, all personnel, attestations, training, procedures, controls, and documentation within the CDE (Cardholder Data Environment). Periodically, additional information and follow-up interviews may be requested and visits to Northwestern Merchant locations may take place with or without notice.
At the discretion of e-Commerce Operations, audits by an external PCI-Certified QSA (Qualified Security Assessor) may occasionally be requested in order to comprehensively review a Merchant card location's credit card operations. The intention of these activities is to reduce the University's risk by ensuring that merchants comply with PCI DSS. Failure to cooperate with such activities may result in your Merchant account being revoked.
All Northwestern Merchants are required to validate PCI DSS compliance at least once, annually, by completing the appropriate TrustKeeper PCI Attestation of Compliance (AOC) SAQ in a timely manner (prior to expiration). A separate questionnaire must be completed for each Merchant account, and a new questionnaire must be filled out whenever any of the following have occurred:
payment processing system changes
a year has elapsed since your last SAQ
you have been prompted to do so by e-Commerce Operations
Treasury Services maintains a contract with Trustwave to centrally manage PCI-DSS validation through the TrustKeeper Portal, which is available in the CardConnect CardPointe gateway. All SAQs should be completed through the TrustKeeper Portal.
The PCI SSC has issued Instructions and Guidelines, plus 8 types of SAQs for Merchants in the Document Library of its website. e-Commerce Operations will help determine which SAQ applies to your situation. The table below lists all of the current SAQ form types, along with their general definitions.
PCI DSS v3.2 Self-Assessment Questionnaire (SAQ) Types and Eligibility Criteria
Card-not-present merchants (e-commerce or mail/telephone order) that have fully outsourced all cardholder data functions to PCI DSS compliant third-party service providers, with no electronic storage, processing, or transmission of any cardholder data on the merchant's systems or premises. Not applicable to face-to-face channels.
Card Not Present, E-commerce merchants who outsource all payment processing to PCI DSS validated third parties, and who have a website(s) that doesn't directly receive cardholder data but that can impact the security of the payment transaction. No electronic storage, processing, or transmission of any cardholder data on the merchant’s systems or premises. Applicable only to e-Commerce channels.
Merchants using only Imprint machines with no electronic cardholder data storage and/or Standalone, dial-out terminals with no electronic cardholder data storage. Not applicable to e-Commerce channels.
Merchants using only standalone, PTS-approved payment terminals with an IP connection to the payment processor, with no electronic cardholder data storage. Not applicable to e-commerce channels.
Merchants who manually enter a single transaction at a time via a keyboard into an Internet-based Virtual Terminal solution that is provided and hosted by a PCI DSS validated third-party service provider. No electronic cardholder data storage. Not applicable to e-Commerce channels.
Merchants using only hardware payment terminals that are included in and managed via a validated, PCI SSC-listed P2PE solution, with no electronic cardholder data storage. Not applicable to e-Commerce channels.