1. PCI Compliance Service
Rob Bandler July 26th 2016

2. Agenda Introductions Service Description Value Proposition Metrics
Cost
Security
More Information
Q&A

3. Introductions Service owner: Harper Watters
Service managers: Tim Bradish & Tom Horton
Service Delivery Team Members: Debra Federation & Kevin Mooney

4. Service Description Service name: PCI Compliance Service
Provisioning of PCI compliant network firewalls for organizations handling credit card transactions on campus.
Professional consulting services for meeting and maintaining PCI compliance in partnership with the Treasurer's Office.
Products:
SonicWall firewall hardware
Credit Card Swipe Terminals
Available to:
Proposed and existing campus merchants employed by Cornell
No fee
Service tier: Zero

5. Value Proposition Value proposition Customer impact Key benefits
Available 24/7/365
Certified industry assessors with expertise interpreting PCI compliance requirements.
Access to certified external assessors to leverage Cornell specific skills, experience, and expertise
Customer impact
Reduction of scope/hardware/time/cost in meeting compliance
Clarification on PCI requirements and compliance
Key benefits
Compliant network for processing credit cards
Consulting provides clarification on options and solutions to meet both compliance and required business use case
Provides the university transparency

6. Metrics FY16 Q4 FY 16 Q4 Metrics SonicWALL’s in production 20
Self Assessment Questionnaires(SAQ’s) submitted by merchants 53
Availability
100%

7. Costs Cost to deliver the service: Fee for service: No
Staff Support 5%
Cost to deliver the service:
FY 16 Total Cost
$82,773
Hardware & Software
$729.00
Labor
$74,519.00
Staff Support
$3,762.40
Administrative Overhead
Fee for service: No
Cost per unit: $1,561.75

8. Security What risks does use of the service mitigate?
Financial loss
Reputational harm
Loss of service
How does the service mitigate risks?
Safe default configurations
Regulatory compliance, policy compliance, awareness, prevention
Transparency

9. More Information PCI SIG: Dates broadcast via listserv
PCI contact:
Service catalog entry:
Service quarterly report:

10. Questions?