Credit Card Payment Security Requirements (PCI-DSS)

State Agencies that accept credit, debit, ACH, or other electronic payments must complete an annual payment security review.  These security requirements are known as Payment Card Industry Data Security Standards (PCI-DSS).  Agencies will be responsible for ongoing training, policy development and practice, and completion of a Self-Assessment Questionnaire (SAQ) each year.

There are 9 different SAQs.  Your merchant type, and the methods in which you handle, transmit, and store data will determine which is the right SAQ for your Agency.  OST will work with you to determine the appropriate SAQ type and will then make it available to you through CampusGuard’s online portal.

To get started, Agencies will need to do the following:

1. Complete your Merchant Survey
2. Submit the above survey to PCI_Compliance@delaware.gov
3. OST will review the survey, then contact you to establish a discovery call and guide you through the remaining steps of the process

Treasury staff will assist Delaware Agencies in this endeavor, in partnership with the Department of Technology and Information (DTI) and our contracted data security vendor, Campus Guard.  By working together, we can proactively protect and secure our payment systems.

Contact Information for PCI-DSS

Helpful Resources

• Merchant Payment Systems Procedure Template for State Agencies
• Merchant Inventory Template
• Merchant Tampering Checklist
• NACHA Proposed Data Security Standards for ACH Transactions
• PCI Asset Inventory Tracking Sheet
• PCI Best Practices
• PCI DSS Merchant Survey
• PCI Security Standards Council
• Sample Network Diagram