Best Practices

• NEVER e-mail credit card information.
• Only employees who have a legitimate business “need-to-know” should have access to cardholder information.
• Sanitize credit card numbers on any document where the complete number is visible.
  • Blackout credit card number (first 12 digits) and then photocopy.
  • Shred the original, retain the copy.
  • Cut out/off and shred card information.
• Do not use wireless networks for the processing of Credit Cards.
• Protect computer networks with hardware firewall and intrusion detection / protection.
• Separate and encrypt credit card processing traffic from regular traffic.
• Do not store credit card information online if possible.
  • If it is; Separate with a hardware firewall, and utilize encryption.
  • Monitor network for intrusion and anomalies 24x7.
• Maintain all software, OS updates and virus signatures.
• Limit Internet usage on computers that process credit cards.   
• Only retain information long enough to reconcile payments.
• Shred documentation containing credit card information when it is no longer needed for business or legal reasons.
• Lock computer terminals and paper storage areas when un-attended.