Scope and Definitions. Teleflora Dove POS 5

Teleflora Point of Sales PA-DSS Implementation Guide

Scope and Definitions

In order to reduce retail credit card fraud, Visa and other credit card companies have introduced a new program called “PA-DSS”, Payment Application – Data Security Standards. This new program specifies a number of policies and guidelines needed to maintain a “secure” Point of Sale environment.

Teleflora has made a number of application and procedural changes in order to ensure that your Dove

POS system is compliant with these new PA-DSS requirements. However, to remain compliant, you will be responsible for maintaining some procedures as well.

This document serves to provide a number of “Dove POS Specific” applications to the various Visa PA-

DSS requirements. Please refer to Visa’s “Payment Applications Best Practices” document, as well as the associated “Payment Card Industry Data Security Standard” document for full details on compliance regulations.

Following are definitions for some terms used throughout this document.

Term

PA-DSS

Definition

Payment Applications Data Security

Standards

Cardholder Information

Sensitive Data

Administrative user

“Data Security Standard”

Minimally, a full credit card number.

Could also be a credit card magnetic stripe data, CVV value and/or Debit card “pin” value or Debit card “pin block”.

Either Cardholder information or username/password information.

Any person capable of logging into a Dove

POS workstation, or Dove POS server with

“Administrative’ windows privileges. Or, any person who has administrative privileges to the Dove POS database.

A document, published by Visa, which specifies all polices and requirements fundamental to PA-DSS compliance.

Dove_POS_PA-DSS_Implementation_Guide_v1.3.doc – 2011-11-11 Page 2

Teleflora Point of Sales PA-DSS Implementation Guide

For more information about PCI’s PA-DSS requirements and process, please visit: http://www.pcisecuritystandards.org

In particular, you should obtain and read the following documents:

PCI DSS Version 1.1 Requirements

( https://www.pcisecuritystandards.org/tech/download_the_pci_dss.htm

)

Payment Application Data Security Standard (PA-DSS)

( https://www.pcisecuritystandards.org/security_standards/pa_dss.shtml

)

PCI DSS Self-Assessment Questionnaire

( https://www.pcisecuritystandards.org/pdfs/pci_saq_v1-0.pdf

)

Do note that at the time of this writing, we are using the PCI - Payment Application Data Security

Standard - Security Audit Procedures, version 1.1 (April 2008) and PCI DSS Revision 1.1 documents.

Dove_POS_PA-DSS_Implementation_Guide_v1.3.doc – 2011-11-11 Page 3