| Authorization | Process for Harvard departments to set up credit card merchant accounts and related bank accounts. Includes procedures to process credit card transactions and to manage credit activities. Provides directives for new accounts and internal Harvard resources. |
| Data Protection | Standard credit card provider security rules that have been consolidated as the PCI Data Security Standard. |
| Compliance Certification | Process by which all vendors, including Harvard, are certified to be compliant by an approved third party. The certification process requires completion of an annual questionnaire and quarterly remote vulnerability scans. |
| Transaction Monitoring | Recommended processes and resources for managing the credit card transaction security environment. |
| Disclosing Potential Breaches | Requirements for notification upon discovery of security breach that may jeopardize the security of the protected information. |
| Local Policies | Recommendations for the development of local credit card data management policies. |
