Colleges and universities are fighting a war on two fronts when it comes to payment processing. On one end, students, departments and alumni expect the latest and easiest to use payment technologies. At the same time, your institution is facing increased scrutiny when it comes to securing payments and maintaining PCI compliance while constantly being targeted by hackers who are continuing to evolve in sophistication.
If this wasn’t enough, there are underlying challenges that are unique to the higher education ecosystem. Not only are there a web of business processes and units to account for, they must be secured without disrupting business operations.
Fortunately, there is an existing solution to all of these problems. It’s the double-edged sword of PCI validated point-to-point encryption (P2PE), which enables your university to streamline security and reduce PCI scope. The best part? Cost savings generated far outweigh the cost of implementation. Follow along as we outline the current obstacles to security and compliance, and demonstrate how implementing PCI-validated P2PE can save your university time and money.
The Problem
Securing payment card data is no easy feat for any institution, especially in higher education. The likely presence of multiple payment processors/acquirers on campus, compounded by a patchwork of financial processes and technologies spread across multiple units, leads to increased complexity. Without a proper system in place, it becomes cumbersome to ensure all siloed business units are adhering to updated PCI compliance standards while keeping sensitive cardholder data secure.
Some additional challenges include:
-
Resources: Becoming and remaining PCI compliant can be expensive. Besides for dealing with financial constraints, finding highly skilled security professionals that can maintain PCI compliance across a multi-unit higher education environment can be challenging. As technologies continues to evolve, updating legacy systems to meet new security standards requires significant capital investments in purchasing new solutions and ensuring they are implemented correctly.
-
Legacy Systems: Many universities and colleges operate multiple business units on flat networks, prioritizing up-time optimization over security concerns. The result is overwhelming PCI scope, as data is scattered across disparate systems and technologies.
-
Education: Educating staff on security policies, procedures, and potential threats can be difficult, especially for universities where staff is spread out across multiple units on multiple campuses. It’s essential for everyone along the payments chain (from cashiers to senior management) to understand the reasoning and ramifications of security procedures, as well as the necessary steps to keep card data secure.
Despite these challenges, PCI compliance is not optional. The ability to process payments depends on it. In a time when major data breaches are almost a daily occurrence, it is especially important for universities to remain vigilant. It may be expensive, but the alternative can be even costlier. Non-compliance can overshadow the cost of updating security systems in the form of fines and fees, and as we’ve learned before, data breaches can cost millions in penalties and reputational damage.
The Solution
P2PE is the answer to seamlessly securing cardholder data and significantly reducing PCI scope.
The validated P2PE standard dictates that payment data must be encrypted at the point-of-interaction and decrypted entirely outside of the merchant’s environment (at offsite data centers or the cloud). This ensures that no sensitive cardholder information passes through the merchant’s POS in an unencrypted state. By partitioning card data from the POS and network, P2PE enables merchants to reduce PCI scope and eliminate many controls that need to be managed and documented. The transaction framework applies to all payments methodologies, allowing universities to accommodate online, offline and emerging payments technologies while providing multi-channel security.
The Benefit
P2PE solutions offer several compelling benefits for higher education merchants:
-
Using PCI-validated P2PE reduces PCI scope significantly, shrinking the PCI Self-Assessment Questionnaire from 12 sections to 4 sections and reducing the controls from 329 questions to only 35. As a result, universities can effectively reduce IT infrastructure and staff needed to monitor and maintain secure and compliant workstations.
-
Universities experience greater efficiencies across all departments and business units, as P2PE solutions can serve mixed-processing environments, including call center, online, and face-to-face transactions.
-
As a cornerstone to data security, P2PE technology enables higher education merchants to lower risk along with reducing PCI scope. It can mean the difference between hundreds of thousands of dollars (measured in time and money) when implemented correctly.
The Result
Maintaining PCI compliance is an ongoing task, as regulations and compliance standards are living, breathing things. It requires sharing the responsibilities of payments security among key stakeholders and business units.
Although the task may seem daunting alone, working with a trusted payments partner with a proven track record of implementing P2PE in the higher education space can save you valuable time and resources.
Thankfully, your search can begin and end here. By teaming up with Arrow Payments, you’ll work with payment processing experts who have documented experience with securing payments, maintaining PCI compliance, and implementing P2PE at universities.
Still want more proof? Click to learn how we recently solved the dilemma at Northwestern University, and then schedule a 30-minute phone call with a member of our team:
