Idaho State University eMarket Policy
OVERVIEW
Idaho State University recognizes that departments may need to accept payment for services
rendered. The purpose of this policy is to establish procedures for accepting payment cards and
provide general guidelines for the appropriate way to handle such funds. This policy is intended to
minimize the risk of accepting payments and to provide the greatest value, security, and service to
each University department within the rules, regulations and guidelines established by the Payment
Card Industry (PCI).
This policy applies to all university departments that are involved in the acceptance of payment cards
on behalf of Idaho State University. This includes employees, contractors, consultants, temporary
employees and other workers in the university units. This policy also applies to external applications
linked to an Idaho State University website which accept payment cards and external vendors who
collect, process, or store payment card data on behalf of Idaho State University.
I. DEFINITIONS (as they are used in the following policy)
Cardholder
Customer to whom a card is issued or individual authorized to use the card.
Cardholder Data
Any personally identifiable data associated with the cardholder. This could be an account number,
expiration date, Card Validation Code (CVC), Card Verification Value (CVV), or Card Identification
Number (CID).
CASHNet
Software application used by Idaho State University for recording transactions related to cash,
checks, ACH or payment cards.
CASHNet E-Market
CASHNet E-Market includes Storefront and Checkout solutions that can be used independently or
together, allowing various campus-wide departments to seamlessly accept and authorize payments.
Types of payments are defined by the individual department and can include one-time payments for
events on campus and conference registration fees.
Charge backs
The deduction of a disputed sale previously credited to a university unit’s account when the unit fails
to prove that the customer authorized the credit card transaction.
Payment Cards
Credit cards or debit cards issued by a financial institution. Contact the E-Market Administrator for
acceptable payment cards.
Revised on Nov 2012
Page 1 of 5
Print Form
Payment Card Industry
Payment Card Industry (PCI) is a council formed by the credit card industry (VISA, MasterCard,
Discover, and American Express) to establish Data Security Standards (DSS) for the industry.
https://www.pcisecuritystandards.org.
Point-of-sale Terminal
A point-of-sale (POS) terminal is an electronic terminal and printer where the university unit swipes
a credit card to obtain authorization for the transaction. A receipt is printed which the customer signs.
University Unit
A department, service center, student organization, or other university entity that accepts payments to
conduct business.
II. E-MARKET POLICY
The purpose of this policy is to establish procedures for accepting online payments, including credit
cards at Idaho State University that will minimize risk and provide the greatest value, security, and
service to each university department within the rules, regulations and guidelines established by the
Payment Card Industry (PCI)
III. WHO IS AFFECTED BY THIS POLICY
All university departments that are involved in the acceptance of online credit card payments on
behalf of Idaho State University are affected by this policy. This includes employees, temporary
employees and other workers in the university departments. This policy also applies to external
applications linked to an Idaho State University website which accept payment cards.
IV. WHO SHOULD COMPLY WITH THIS POLICY?
Any university department that conducts business on behalf of Idaho State University through
payment card transactions and any university department responsible for developing and/or
maintaining the infrastructure surrounding accepting credit card payments (i.e. website, software
programs, etc.)
V. CONTACTS
CASHNet Administrator 282-3375, 282-4866
Controller’s Office 282-2511
VI. OVERVIEW OF POLICY
Credit cards may be accepted by university departments for various purposes, including the sale of
goods or services, and donation of gifts. The Controller’s Office may immediately remove any
university department’s ability to accept credit cards and if that unit’s actions violate any part of this
Policy or puts Idaho State University at risk. Please contact the Controller’s Office if you have any
questions regarding permitted transaction types.
Revised on Nov 2012
Page 2 of 5
VII. OVERVIEW OF POLICY
Credit cards may be accepted by university units for various purposes, including the sale of goods
or service
s, and donation of gifts. The Controller's Office may immediately remove any university
unit’s ability to accept credit cards payments if that unit’s actions violate any part of this Policy or
puts the Idaho State University at risk. Please contact the Controller's Office if you have any
questions regarding permitted transaction types.
A. Acceptable Credit Cards
Idaho State University currently accepts VISA and MasterCard for non-tuition related transactions.
Idaho State University has negotiated contracts for processing credit card transactions. Individual
university departments must not attempt to negotiate individual contracts with these or other payment
card companies.
B. Prohibited Credit Card Activities
Idaho State University prohibits certain credit card activities for departments that include, but are not limited to:
Accepting
credi
t cards for tuition and fees.
Accepting credit cards for cash advances.
Discounting a good or service based on the method of payment.
Using a paper imprinting system.
Storing in anyway credit card information in paper files, on network drives, or hard drives on
university computers.
C. Credit Card Fees
Each credit card transaction will have a merchant fee charged by the credit card company. Each
university department processing credit card transactions will be charged for all credit card fees
associated with transactions originating from their department.
D. Refunds for Credit Card Transactions
When a good or service is purchased using a credit card, and a refund is necessary, the refund must
be credited back to the account that was originally charged. Idaho State University prohibits refunds
in excess of the original sale amount. Idaho State University also prohibits cash refunds. If a refund
needs to be processed please contact Weston Whitworth at 282-3375.
E. Charge backs for Credit Card Transactions
Occasionally a customer will dispute a credit card transaction, ultimately leading to a chargeback. If
not resolved, the transaction will be charged back against the university department’s general ledger
account.
H. Maintaining Security
Every university department accepting credit card payments on behalf of Idaho State
University is subject to the Payment Card Industry Data Security Standards (PCI DSS).
Idaho State University does not allow credit card and checking account data transmission via
fax, e-mail, unsealed envelopes through campus mail, or wireless networks, as these are not
secure.
Revised on Nov 2012
Page 3 of 5
Idaho State University requires that all external service providers be PCI compliant.
Access to cardholder data and checking account information is restricted to those with a
business need to know.
For electronic media, cardholder data should not be stored in its entirety on servers, local
hard drives, or external (removable) media including floppy discs, CDs, and thumb drives
(also called flash drives).
For paper media (e.g. paper receipts and forms), cardholder data should not be stored.
VIII. Procedures
Idaho State University requires the proper procedures be followed in order to grant the creation and
use of an eMarket site. All required Idaho State University signatures are needed for approval prior
to the start of an eMarket site. Please be sure to allow at least three (3) weeks for implementation of
an eMarket site.
A. Obtaining Approval for an E-Market
Idaho State University requires all university units interested in using an eMarket site to obtain the
proper approvals. A Request for E-Market Checkout” form, see Attachment A, needs to be
completely filled out prior to initiating a request. Please note that this form is for information
purposes only to be used in determining the necessity of creating your E-Market request (See
Attachment A). The E-Market Administrator has final approval to create or publish an E-Market
Checkout.
The form requires the following information be identified:
Department information, including contact information.
Questions answered regarding the need for an E-Market and the type of transactions you will
be processing.
Approval Signatures.
Person requesting the E-Market Checkout
Dean/Department Head
University Business Officer
B. Final Approval
The following approval is needed prior to the final implementation of an E-Market Checkout:
E-Market Administrator
C. E-Market Checklist Form
The E-Market Checklist form is used by the E-Market Administrator to track progress throughout the
creation of a new E-Market. The E-Market Administrator is required to update this form as each task
is completed. A copy of the form should be filed with all documentation regarding the creation and
implementation of an E-Market Checkout.
Revised on Nov 2012
Page 4 of 5
This statement of responsibility regarding the use of data contained within CASHNet system
must be read and agreed to by the end user prior to the granting of access to this system.
By signing this form, I acknowledge that I have read and agreed to adhere to the CashNet
eMarket policy.
I understand that I will be violating university policies and state and federal law if I gain or
help others gain unauthorized access to CASHNet system. I acknowledge that neither I nor
anyone else possesses the authority to allow anyone to use my CASHNet Id or password.
I understand that if I violate university policies and state and federal laws by gaining or
helping others gain unauthorized access to this system, I will be subject to university
disciplinary action and criminal prosecution to the full extent of the law.
By logging on to these computer systems, I acknowledge my responsibility for strictly
adhering to university policy and state and federal law. I am also aware that penalties exist
for unauthorized access, unauthorized use, or unauthorized distribution of information from
CASHNet system.
I agree further not to attempt to circumvent the computer security system nor to attempt to
use any transactions, software, computer files, or resources that I am not authorized to use.
Any information downloaded from these systems and transported on portable devices
(laptops, thumb drives, etc.) will be encrypted.
_________________________________________________________________________________
CASHNet User (Signature) Date
_________________________________________________________________________________
Supervisor/Manager/Approver Print Name Date Phone #
Return Completed Form to the Controller's Office - Stop 8219
(Signature)
Revised on Nov 2012
Page 5 of 5
click to sign
signature
click to edit
click to sign
signature
click to edit