Payment Card Industry Data Security Standards (PCI DSS) Incident Response Plan

University of North Carolina at Chapel Hill Payment Card Industry Data Security Standards (PCI DSS) Incident Response Plan

The UNC-Chapel Hill Incident Management Policy requires "every faculty member, staff member, student, temporary employee, contractor, outside vendor, and visitor to campus (AKA User) who has access to University-owned or managed information through computing systems, devices, or physical files" to "report Information Security Incidents" per the procedures defined. As defined in the UNC-Chapel Hill Incident Management Policy, sensitive information includes "card holder data," as defined by the Payment Card Industry Data Security Standards.

As stated in the UNC-Chapel Hill Incident Management Policy, the Information Technology Services (ITS) Information Security Office (ISO), in conjunction with the Office of University Counsel and the affected University department, shall direct the incident response and investigation. ITS ISO, the Office of University Counsel, and the affected University department will coordinate on business recovery procedures, business continuity procedures, and data back-up processes, as appropriate. Coordination of activities may include the UNC Police when physical files are involved.

Specific incident response procedures are defined in the UNC-Chapel Hill Incident Management Procedures, consistent with availability to appropriate personnel. Communication and contact strategies in the event of an "Information Security Incident" are defined in the "Incident Reporting" section of the Incident Management Procedures, consistent with availability to appropriate personnel. The ITS ISO will work with the Office of University Counsel, as appropriate, to contact the Office of State Controller in the event of a reportable incident.

Specific procedures are documented in protected help.unc.edu documents and other locations specific to the groups with a business need to access the documents.

As a part of the incident response process, consultation of incident response procedures proposed by the payment brands may be required:

• American Express - Data Security Operating Policy
• MasterCard - Account Data Compromise Event Management Best Practices
• Visa - Responding to a Data Breach
• Visa - What To Do If Compromised

Related Requirements

External Regulations and Consequences

• PCI Security Standards Council, Payment Card Industry Data Security Standards (PCI DSS)

University Policies, Standards, and Procedures

• UNC-Chapel Hill Incident Management Policy
• UNC-Chapel Hill Incident Management Procedure
• UNC-Chapel Hill Finance Policy 308: Policy on Merchant Card Services
• UNC-Chapel Hill Payment Card Industry, incident management specific procedures can be found in the Information Security Office wiki and on the School of Medicine/ISO share drive.

Document History

• Effective Date: 10/01/14
• Review Date: 9/16/2014, 10/13/2015 (CISO), 10/17/2016 (CISO), 10/13/2017 (CISO) 10/7/2018 (CISO delegate)