Payment Card Industry (PCI) - FAQ

Q: What is PCI?
A: The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that ALL companies that process, store or transmit credit card information maintain a secure environment. Essentially any merchant that has a Merchant ID (MID).
The Payment Card Industry Security Standards Council (PCI SSC) was launched on September 7, 2006 to manage the ongoing evolution of the Payment Card Industry (PCI) security standards with focus on improving payment account security throughout the transaction process. The PCI DSS is administered and managed by the PCI SSC (www.pcisecuritystandards.org), an independent body that was created by the major payment card brands (Visa, MasterCard, American Express, Discover and JCB.).
It is important to note, the payment brands and acquirers are responsible for enforcing compliance, not the PCI council.
A copy of the PCI DSS is available here.

 

Q: To whom does PCI apply?
A: PCI applies to ALL organizations or merchants, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data. Said another way, if any customer of that organization ever pays the merchant directly using a credit card or debit card, then the PCI DSS requirements apply.

 

Q: Where can I find the PCI Data Security Standards (PCI DSS)?
A: The Standard can be found on the PCI SSC's Website:
The PCI Security Standards Council offers robust and comprehensive standards and supporting materials to enhance payment card data security. These materials include a framework of specifications, tools, measurements and support resources to help organizations ensure the safe handling of cardholder information at every step. The keystone is the PCI Data Security Standard (PCI DSS), which provides an actionable framework for developing a robust payment card data security process -- including prevention, detection and appropriate reaction to security incidents.
Tools to assist organizations validate their PCI DSS compliance include Self Assessment Questionnaires. The chart linked here shows some of the tools available to help organizations become PCI DSS-compliant.
For device vendors and manufacturers, the Council provides the PIN Transaction Security (PTS) requirements, which contains a single set of requirements for all personal identification number (PIN) terminals, including POS devices, encrypting PIN pads and unattended payment terminals. A list of approved PIN transaction devices can be accessed here.
To help software vendors and others develop secure payment applications, the Council maintains the Payment Application Data Security Standard (PA-DSS) and a list of Validated Payment Applications.
The Council also provides training to professional firms and individuals so that they can assist organizations with their compliance efforts. The Council maintains public resources such as lists of Qualified Security Assessors (QSAs), Payment Application Qualified Security Assessors (PA-QSAs), and Approved Scanning Vendors (ASVs). Large firms seeking to educate their employees can take advantage of the Internal Security Assessor (ISA) education program



Q: What are the PCI compliance deadlines?
A: All merchant that stores, processes or transmits cardholder data must be compliant now. However, as a Level 4 merchant, you will have to refer to your merchant bank for their specific validation requirements and deadlines. All deadline enforcement will come from your merchant bank. You may also find more information on Visa’s Website:
http://usa.visa.com/download/merchants/payment_application_security_mandates.pdf.

back to top

Q: What are the PCI compliance ‘levels’ and how are they determined?
A: All merchants will fall into one of the four merchant levels based on Visa transaction volume over a 12-month period. Transaction volume is based on the aggregate number of Visa transactions (inclusive of credit, debit and prepaid) from a merchant Doing Business As (‘DBA’). In cases where a merchant corporation has more than one DBA, Visa acquirers must consider the aggregate volume of transactions stored, processed or transmitted by the corporate entity to determine the validation level. If data is not aggregated, such that the corporate entity does not store, process or transmit cardholder data on behalf of multiple DBAs, acquirers will continue to consider the DBA’s individual transaction volume to determine the validation level.
Merchant levels as defined by Visa:

Merchant Level	Description
1	Any merchant -- regardless of acceptance channel -- processing over 6M Visa transactions per year. Any merchant that Visa, at its sole discretion, determines should meet the Level 1 merchant requirements to minimize risk to the Visa system.
2	Any merchant -- regardless of acceptance channel -- processing 1M to 6M Visa transactions per year.
3	Any merchant processing 20,000 to 1M Visa e-commerce transactions per year.
4	Any merchant processing fewer than 20,000 Visa e-commerce transactions per year, and all other merchants -- regardless of acceptance channel -- processing up to 1M Visa transactions per year.

* Any merchant that has suffered a hack that resulted in an account data compromise may be escalated to a higher validation level.
Source: http://usa.visa.com/merchants/risk_management/cisp_merchants.html

 

Q:	What does a small-to-medium sized business (Level 4 merchant) have to do in order to satisfy the PCI requirements?

A: To satisfy the requirements of PCI, a merchant must complete the following steps:

• Identify your Validation Type as defined by PCI DSS – see below . This is used to determine which Self Assessment Questionnaire is appropriate for your business.

 

• Complete the Self-Assessment Questionnaire according to the instructions in the Self- Assessment Questionnaire Instructions and Guidelines.

• Complete and obtain evidence of a passing vulnerability scan with a PCI SSC Approved Scanning Vendor (ASV). Note scanning does not apply to all merchants. It is required for Validation Type 4 and 5 – those merchants with external facing IP addresses. Basically if you electronically store cardholder information or if your processing systems have any internet connectivity, a quarterly scan by an approved scanning vendor is required.

• Complete the relevant Attestation of Compliance in its entirety (located in the SAQ tool).

• Submit the SAQ, evidence of a passing scan (if applicable), and the Attestation of Compliance, along with any other requested documentation, to your acquirer.

• I’m a small merchant with very few card transactions; do I need to be compliant with PCI DSS?

All merchants, small or large, need to be PCI compliant. The payment brands have collectively adopted PCI DSS as the requirement for organizations that process, store or transmit payment cardholder data.

 

Q: If I only accept credit cards over the phone, does PCI still apply to me?
A: Yes. All business that store, process or transmit payment cardholder data must be PCI Compliant.

 

Q: Do organizations using third-party processors have to be PCI compliant?
A: Yes. Merely using a third-party company does not exclude a company from PCI compliance. It may cut down on their risk exposure and consequently reduce the effort to validate compliance. However, it does not mean they can ignore PCI.

 

Q: My business has multiple locations, is each location required to validate PCI Compliance?
A: If your business locations process under the same Tax ID, then typically you are only required to validate once annually for all locations. And, submit quarterly passing network scans by an PCI SSC Approved Scanning Vendor (ASV), if applicable.

 

Q: Are debit card transactions in scope for PCI?
A: In-scope cards include any debit, credit, and pre-paid cards branded with one of the five card association/brand logos that participate in the PCI SSC - American Express, Discover, JCB, MasterCard, and Visa International.

 

Q: Am I PCI compliant if I have an SSL certificate?
A: No. SSL certificates do not secure a Web server from malicious attacks or intrusions. High assurance SSL certificates provide the first tier of customer security and reassurance such as the below, but there are other steps to achieve PCI Compliance. See Question “What does a small-to-medium sized business (Level 4 merchant) have to do in order to satisfy the PCI requirements?”

• A secure connection between the customer's browser and the web server
• Validation that the Website operators are a legitimate, legally accountable organization

 

Q: What are the penalties for noncompliance?
A: The payment brands may, at their discretion, fine an acquiring bank $5,000 to $100,000 per month for PCI compliance violations. The banks will most likely pass this fine on downstream till it eventually hits the merchant. Furthermore, the bank will also most likely either terminate your relationship or increase transaction fees. Penalties are not openly discussed nor widely publicized, but they can catastrophic to a small business.
It is important to be familiar with your merchant account agreement, which should outline your exposure.

 

Q: What is defined as ‘cardholder data’?
A: Cardholder data is any personally identifiable data associated with a cardholder. This could be an account number, expiration date, name, address, social security number, etc. All personally identifiable information associated with the cardholder that is stored, processed, or transmitted is also considered cardholder data.

 

Q: What is the definition of ‘merchant’?
A: For the purposes of the PCI DSS, a merchant is defined as any entity that accepts payment cards bearing the logos of any of the five members of PCI SSC (American Express, Discover, JCB, MasterCard or Visa) as payment for goods and/or services. Note that a merchant that accepts payment cards as payment for goods and/or services can also be a service provider, if the services sold result in storing, processing, or transmitting cardholder data on behalf of other merchants or service providers. For example, an ISP is a merchant that accepts payment cards for monthly billing, but also is a service provider if it hosts merchants as customers
Source: PCI SSC

 

Q: What constitutes a Service Provider?
A: Any company that stores, processes, or transmits cardholder data on behalf of another entity is defined to be a Service Provider by the Payment Card Industry (PCI) guidelines.

 

Q: What constitutes a payment application?
A: What constitutes a payment application as it relates to PCI Compliance? The term payment application has a very broad meaning in PCI. A payment application is anything that stores, processes, or transmits card data electronically. This means that anything from a Point of Sale System (e.g., Verifone swipe terminals, ALOHA terminals, etc.) in a restaurant to a Website e-commerce shopping cart (e.g., CreLoaded, osCommerce, etc) are all classified as payment applications. Therefore any piece of software that has been designed to touch credit card data is considered a payment application.

 

Q: What is a payment gateway?
A: Payment Gateways connect a merchant to the bank or processor that is acting as the front-end connection to the Card Brands. They are called gateways because they take many inputs from a variety of different applications and route those inputs to the appropriate bank or processor. Gateways communicate with the bank or processor using dial-up connections, Web-based connections or privately held leased lines.

 

Q: How is IP-based POS environment defined?
A: The point of sale (POS) environment refers to a transaction that takes place at a merchant location (i.e. retail store, restaurant, hotel, gas station, convenience store, etc.). An Internet protocol (IP) -based POS is when transactions are stored, processed, or transmitted on IP-based systems or systems communicating via TCP/IP.

 

Q: What is PA-DSS and PABP?
A: PA-DSS refers to Payment Application Data Security Standard maintained by the PCI Security Standards Council. PABP is Visa’s Payment Application Best Practices, which is now referred to as PA-DSS. Visa started the program and it is being transitioned to the PCI Security Standards Council (PCI SSC).
To address the critical issue of payment application security, in 2005 Visa created the Payment Application Best Practices (PABP) requirements to ensure vendors provide products which support merchants' efforts to maintain PCI DSS compliance and eliminate the storage of sensitive cardholder data. See www.visa.com/pabp for more information.
The Payment Card Industry Security Standards Council (PCI SSC) will maintain the PA-DSS and administer a program to validate payment applications' compliance against this standard. The PCI SSC now publishes and maintains a list of PA-DSS validated applications. 
VISA MANDATE PHASE DEADLINE

1. New PCI Level 4 merchants (including new locations of existing relationships) may not use vulnerable payment application versions – those that store prohibited cardholder data. January 1, 2008
2. New PCI Level 4 merchants using third-party payment software must be either PCI DSS-compliant or use PA-DSS validated compliant payment applications. October 1, 2008
3. ALL PCI Level 4 merchants (new and existing) using third-party software must use validated applications. July 1, 2010

 

Q: Can the full credit card number be printed on the consumer’s copy of the receipt?
A: PCI DSS requirement 3.3 states "Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed).” While the requirement does not prohibit printing of the full card number or expiry date on receipts (either the merchant copy or the consumer copy), please note that PCI DSS does not override any other laws that legislate what can be printed on receipts (such as the U.S. Fair and Accurate Credit Transactions Act (FACTA) or any other applicable laws). See the italicized note under PCI DSS requirement 3.3 “Note: This requirement does not apply to employees and other parties with a specific need to see the full PAN, nor does the requirement supersede stricter requirements in place for displays of cardholder data (for example, for point of sale (POS) receipts).” Any paper receipts stored by merchants must adhere to the PCI DSS, especially requirement 9 regarding physical security.
Source: PCI SSC

 

Q: Do I need vulnerability scanning to validate compliance?
A: If you electronically store cardholder data post authorization or if your processing systems have any internet connectivity, a quarterly scan by a PCI SSC Approved Scanning Vendor (ASV) is required.

 

Q: What is a network security scan?
A: A network security scan involves an automated tool that checks a merchant or service provider's systems for vulnerabilities. The tool will conduct a non-intrusive scan to remotely review networks and Web applications based on the external-facing Internet protocol (IP) addresses provided by the merchant or service provider. The scan will identify vulnerabilities in operating systems, services, and devices that could be used by hackers to target the company's private network. As provided by an Approved Scanning Vendors (ASV’s) such as ControlScan the tool will not require the merchant or service provider to install any software on their systems, and no denial-of-service attacks will be performed.
Note, typically only merchants with external facing IP address are required to have passing quarterly scans to validate PCI compliance. This is usually merchants completing the SAQ C or D version.

 

Q: How often do I have to scan?
A: Every 90 days/once per quarter you are required to submit a passing scan. Merchants and service providers should submit compliance documentation (successful scan reports) according to the timetable determined by their acquirer. Scans must be conducted by a PCI SSC Approved Scanning Vendor (ASV). ControlScan is a PCI Approved Scanning Vendor.

 

Q: What if a merchant refuses to cooperate?
A: PCI is not, in itself, a law. The standard was created by the major card brands such as Visa, MasterCard, Discover, AMEX, and JCB. At their acquirers/service providers discretion, merchants that do not comply with PCI DSS may be subject to fines, card replacement costs, costly forensic audits, brand damage, etc., should a breach event occur.
For a little upfront effort and cost to comply with PCI, you greatly help reduce your risk from facing these extremely unpleasant and costly consequences.

 

Q: If I’m running a business from my home, am I a serious target for hackers?
A: Yes, home users are arguably the most vulnerable simply because they are usually not well protected. Adopting a 'path of least resistance' model, intruders will often zero-in on home users - often exploiting their 'always on' broadband connections and typical home use programs such as chat, Internet games and P2P files sharing applications. ControlScan’s scanning service allows home users and network administrators alike to identify and fix any security vulnerabilities on their desktop or laptop computers.

 

Q: What should I do if I’m compromised?
A: We recommend following the procedures outlined in Visa’s” What to Do If Compromised
Visa Fraud Control and Investigations Procedures” document. Link below.
http://usa.visa.com/download/merchants/cisp_what_to_do_if_compromised.pdf

 

Q: Do states have laws that requiring data breach notifications to the affected parties?
A: Absolutely. California is the catalyst for reporting data breaches to affected parties. The state implemented breach notification law in 2003 and there are now over 38 states that have similar laws in place. See www.privacyrights.org for more detail on state laws.

Data Security Guide:Common Technical and Legal Terms — A Glossary

Term	Explanation
Adware	A type of software that often comes with free downloads. Some adware displays ads on your computer, while some monitors your computer use (including websites visited) and displays targeted ads based on your use.
Anti-virus software	Software that protects your computer from viruses that can destroy your data, slow your computer's performance, cause a crash, or even allow spammers to send email through your account.
Bookmark	A web browser feature that allows you to save the addresses of interesting or frequently used websites, so that you can readily revisit them.
Broadband	A number of different methods used for high speed Internet access such as DSL, cable modems, fiber optics, and mobile wireless, all of which are permanently connected to the Internet through different means.
Browser hijacker	A common spyware program that changes your web browser's home page without the user's knowledge, even if you change it back.
Cache	A form of computer memory that allows you to quickly access stored information, such as web addresses you've recently typed into your browser. Pronounced "cash."
Cookies	A small text file that a website can place on your computer's hard drive to collect information about your activities on the site or to allow the site to remember information about you and your activities.
Data security incident	A situation in which you believe that electronic data that contains personal information (see definition) may have been improperly accessed or acquired.
Domain	A segment of Internet space, denoted by the function or type of information it includes; current domains include ".com" for commercial sites, ".gov" for governmental ones, and ".org" for non-commercial organizations.
Drive-by download	Software that installs on your computer without your knowledge when you visit certain websites. To avoid drive-by downloads, make sure to update your operating system and web browser regularly.
DSL	Digital Subscriber Line: A type of high speed Internet using standard phone lines and the local telephone network. DSL is almost always slower than cable modem or fiber optics.
Encryption	The scrambling of data into a secret code that can be read only by software set to decode the information.
Endpoint	Any computer desktop, laptop, or server.
Extended Service Set Identifier (ESSID)	The name a manufacturer assigns to a router. It may be a standard, default name assigned by the manufacturer to all hardware of that model. Users can improve security by changing to a unique name. Similar to a Service Set Identifier (SSID).
Filter	Software that screens information on the Internet, classifies its content, and allows the user to block certain kinds of content.
Firewall	Hardware or software that helps keep hackers from using your computer to send out your personal information without your permission. Firewalls watch for outside attempts to access your system and block communications to and from sources you don't permit.
FTC	The Federal Trade Commission. See www.ftc.gov.
GLBA	The Financial Modernization Act of 1999, also known as the Gramm-Leach-Bliley Act. Pub. L. 106-102, codified at 15 U.S.C. §§ 6801-6809 and §§ 6821-6827 as amended. A full copy of the Act is available at http://www.gpo.gov/fdsys/pkg/PLAW-106publ102/pdf/PLAW-106publ102.pdf
Hacker	Someone who uses computers and the Internet to access other people's computers without permission.
Hardware	The mechanical parts of a computer system, including the central processing unit (CPU), monitor, keyboard, and mouse, as well as other equipment like printers and speakers.
HIPAA	The Health Insurance Portability and Accountability Act. Pub. L. 104-191, 110 Stat. 1936, codified at 29 U.S.C. §§ 1181, 1320, 1395. A full copy of the Act is available at www.cms.hhs.gov/HIPAAGenInfo/Downloads /HIPAALaw.pdf
HTTP (Hypertext Transfer Protocol)	The standard language that computers connected to the World Wide Web use to communicate with each other.
Internet Protocol (IP)	The computer language that allows computer programs to communicate over the Internet.
IP address	A computer's "address," it consists of a series of numbers separated by periods.
Keystroke logger	A device or program that records each keystroke typed on a particular computer.
LAN (Local Area Network)	A network of connected computers that are generally located near each other, such as in an office or company.
Malware	A combination of the terms "malicious" and "software," used to describe any software designed to 'infect' a single computer, server, or computer network. Malware includes malicious software, such as viruses, Trojans, key loggers, spyware, etc — programs used to steal sensitive data. Once in your computer, they can steal information, send spam, and commit fraud.
Media Access Control (MAC) address	A unique number that the manufacturer assigns to each computer or other device in a network.
Monitoring software	Programs that allow a parent or caregiver to monitor the websites a child visits or email messages he or she reads, without blocking access.
Network	A group of two or more computers that are able to communicate with one another.
Online banking credentials	The unique identification used by consumers when they are accessing systems that transmit financial data. These credentials often include, but are not limited to, a username, password, smart card, token, or a biometric.
Online profiling	Compiling information about consumers' preferences and interests by tracking their online movements and actions in order to create targeted ads.
Operating system	The main program that runs on a computer. An operating system allows other software to run and prevents unauthorized users from accessing the system. Major operating systems include UNIX, Windows, MacOS, and Linux.
P2P, peer-to-peer	A method of sharing files, usually music, games, or software, with other users through a sharing program that allows uploading and downloading files from other users online. Caution should be used — P2P files are often misrepresented and can contain offensive material, malware, viruses, or other unintended items.
PCI	The term "PCI" stands for Payment Card Industry.
PCI Data Security Standard	This refers to a data security standard promulgated by members of the payment card industry. Additional information about the PCI Data Security Standard can be found at www.pcisecuritystandards.org.
Personal digital assistant (PDA)	A handheld device that combines various forms of traditional computer and telecommunications products. Common examples are BlackBerry phones, iPhones, and other smartphones.
Personal information or Personally Identifiable Information (PII)	Information that can identify you, like your bank and credit card account numbers; your Social Security number (SSN); or your name, address, phone numbers, email addresses, or date of birth.
Phishing	A scam that involves Internet fraudsters who send spam or pop-up messages through email or social media to lure personal information (credit card numbers, bank account information, Social Security numbers, passwords, or other sensitive information) from unsuspecting victims.
RAM	Short-hand for "Random Access Memory," it's the hardware inside your computer that retains memory on a short-term basis and stores information while you work.
Router	A device that connects two or more networks. A router finds the best path for forwarding information across the networks.
Secure Socket Layer (SSL)	A protocol developed for transmitting private documents via the Internet.
Sock puppet	A secret alias used by a member of an Internet community, but not acknowledged by that person.
Software	A computer program with instructions that enable the computer hardware to work. System software — such as Windows or MacOS — operate the machine itself, and applications software — such as spreadsheet or word processing programs — provide specific functionality.
Spam	Unsolicited commercial email, often sent in bulk quantities.
Spam zombies	Home computers that have been taken over by spammers without the consent or knowledge of the computer owner. The computers are then used to send spam in a way that hides the true origin.
Spammer	Someone who sends unsolicited commercial email, often in bulk quantities.
Spyware	A software program that may be installed on your computer without your consent to monitor your use, send pop-up ads, redirect your computer to certain websites, or record keystrokes, which could lead to identity theft.
Trojans	Programs that, when installed on your computer, enable unauthorized people to access it and sometimes to send spam from it.
Universal Serial Bus (USB)	A connection standard that allows data to be transferred between a computer and a peripheral device such as a mouse, a keyboard, or an external hard drive. The USB port, has largely replaced the serial port and the parallel port found on older products.
Virus	A program that can sneak onto your computer — often through an email attachment — and then make copies of itself, quickly using up all available memory.
Wi-Fi protected access (WPA)	A security protocol developed to fix flaws in WEP. Encrypts data sent to and from wireless devices within a network.
Wired equivalent privacy (WEP)	A security protocol that encrypts data sent to and from wireless devices within a network. Not as strong as WPA encryption.
Wireless network	A method of accessing high speed Internet without the computer being linked by cables.
Worm	A program that reproduces itself over a network and can use up your computer's resources and possibly shut your system down

Data Security Guide:If Third-Parties Request Personal Data — How to Respond

Before providing any personal information to a third-party you should make sure that they are actually authorized to have that information.

Getting Started

Here are some guidelines to help you and your employees determine who is and who is not authorized to obtain personal information about your customers.

1. Requests from your customers.
   In general, customers are authorized to find out what information you keep about them.
2. Requests from individuals connected with your customers.
3. Requests from the government.
   If you receive a request from your state or the federal government to obtain personal information about your customers, and your customers have not consented to the release of their data pursuant to such requests, consult your attorney.
4. Requests from other people.

Checklists

Requests from Individuals Authorized by Your Customers

• If your customer indicates that he/she wants someone else to see the information that you keep about the customer, consider that third-party as now "authorized."
• However...if you receive a request from a third-party (e.g. a family member, attorney, or health care provider) for information about your customer...
  • Require written authorization. (e.g., a consent form, or a power-of-attorney) which has been signed and notarized by your customer.
  • Carefully read the written authorization. Make sure that the written authorization encompasses the type of information that you maintain about the individual.

Requests from the Government

Consider the following:

• Don't assume that a government request is “authorized.”Just because a request comes from the government does not mean that the government is “authorized” to obtain personal information.
• Try to comply with the request without providing personal information. Sometimes government agencies request documents that include personal information without realizing it.
• If you and your attorney decide to comply with a government request, consider asking the government if you can delete the personal information that may be in the document.

Requests from Other People

• Other people, companies, or organizations that request personal information about your customers generally are not considered "authorized." For such requests, consider:
  • Requiring a formal request — in writing.
  • Consulting with your attorney.
  • After consulting with your attorney, and/or the customer, respond to the request in writing and keep a copy of your response.
• If you receive a subpoena from an attorney do not assume that the request is "authorized."
  • The mere fact that someone issues a subpoena does not mean that you must provide the information that they request.
  • Immediately consult your attorney who can help you decide how to respond to the subpoena.

U.S. Legal Requirements

Federal and state laws require businesses to take steps to prevent personal information from being obtained by "unauthorized" individuals, and to alert consumers, and the government, if "unauthorized" individuals access and/or acquire that information.As a result, businesses must ensure that they only release information to "authorized" third parties.

• Responding to Subpoenas
  www.citmedialaw.org/legal-guide/responding-subpoenas

Data Security Guide:Doing Buisness Abroad — Data Security Issues to Consider

Data protection and information security laws and regulations can differ dramatically between countries. Small businesses doing business outside of the United States should consult an attorney to determine what, if any, legal requirements apply to data that you obtain abroad.

Getting Started

Because of the differences in data protection standards, laws, and practices from country to country, you should consult with an attorney that is familiar with the laws of each of the foreign countries in which you do business.

Checklists

When talking to your attorney consider asking the following questions:

• What types of information are protected in the foreign country?
• Are there any restrictions on how information can be collected in the foreign country?
• Are there any restrictions on how information must be stored in the foreign country?
• Are there any restrictions on how information can be used in the foreign country?
• Are there any laws limiting how long information can be stored once it is collected?
• Can information collected by my business in the foreign country be transferred to the United States, or does it have to be stored and used in that country?
• If I transfer information to the United States, am I restricted from providing that information to other parties, such as companies that assist my business with administrative support?
• Do any restrictions apply to information that I maintain about employees that I hire in foreign countries?
• What data security standards apply to data collected in a foreign country—if the data is stored there, or in the United States?

U.S. Legal Requirements for Overseas Transactions

Different countries take different approaches to data protection and information security.
For example, the European Union considers any information relating to an identified or identifiable person to be protected "personal information."
Among other things, privacy laws in the European Union restrict companies from transferring personal information from member states of the European Union to countries, like the United States, that the European Union considers to have inadequate data protection laws.
As a result, a small business may have to take special steps to transfer personal information from the European Union to the United States — even if that information is being transferred within the small business. It will have to consider how to maintain the security of that information in accordance with applicable laws of the EU and its member states, as well as the United States.
One simple method for a US companies to receive multiple data transfers from all member states of the European Union, plus Switzerland, is to join the US-EU and US-Swiss Safe Harbor programs operated by the US Department of Commerce. Participating businesses must self-certify their compliance with seven Safe Harbor Privacy Principles, including a security principle that requires “organizations creating, maintaining, using or disseminating personal information” to take “reasonable precautions to protect it from loss, misuse and unauthorized access, disclosure, alteration and destruction.”

Data Security Guide:If Customer Data is Stolen or Lost — What to Do Next

A small business must respond quickly if sensitive customer information is lost or stolen. Among other things, you may need to notify the affected customers and state and/or federal regulators. This process will run more smoothly if you have taken steps to prepare in advance of a data breach by creating and publishing your breach notification policy, and by ensuring that your employees are trained to identify and report potential breaches soon after they occur.

Getting Started

1. Create a sata breach notification policy.
   A data breach notification policy tells consumers how your small business will notify its customers if a data breach occurs.
2. Train your employees to identify breaches.
   Employees need to know how to spot a potential breach and how to report this type of event.
3. Immediately gather the facts of a potential breach.
4. Notify financial institutions.
   If financial information, such as payment card numbers, was compromised, contact the bank or company that manages your payment card processing.
5. Seek outside counsel.
   Seek attorney assistance as soon as you become aware of an incident that might constitute a data security breach. Your attorney can help you identify which laws might be involved, and whether you need to alert consumers or the government of the incident.
6. Notify affected customers.
   Notify customers in the manner you said you would in your Data Security Policy.

Checklists

1. Create and publish a data breach notification policy.
   
   • Consider informing consumers that you will notify them through a quicker and relatively inexpensive method (e.g., email or publication) instead of a more expensive method (e.g., US mail). However, there are state-specific laws on the notification delivery method, so consult with an attorney before sending out any notices.
2. Train your employees to identify breaches.
   Consider the following points for your employee training:
   • Teach employees what constitutes a "data breach." They should be aware that this might include errors such as inadvertently sending information to the wrong person via mail or email.
   • Instruct employees to report any event where personal information is accessed, acquired by, or shared with an unauthorized person to you or to a specific supervisor.
   • Consider providing employees a confidential means of reporting a data breach. This can be particularly useful if your employees might be afraid that reporting a data breach might result in disciplinary action against them or one of their colleagues.
3. Immediately gather the facts of a potential breach.
   • Investigate the basic facts surrounding the incident.
   • Keep a written chronology of what you learn, when you learned it, and from whom.
   • If your business is short on internal resources, consider obtaining the assistance and guidance of a data forensic expert to assist in your investigation.
   • Your investigation should try to answer the following questions:
     • Was the data kept on paper or in an electronic record?
     • If the data was kept electronically, was it encrypted?
     • Did the data include names and/or addresses?
     • Did the data include any financial account numbers or payment card numbers?
     • Did the data include any birth dates?
     • Did the data include any Social Security numbers?
     • Did the data include any other information that could be linked to specific consumers?
     • How many people's information was included?
     • In what states did the affected people reside?
     • In what countries did the affected people reside, and what languages do they speak?
     • Who (if anyone) acquired the data?
     • Did the person or entity who acquired it misuse it? Are they likely to misuse it in the future?
   • If you think you need help, consult with a data forensics team to investigate and determine the full extent of the event.
4. Notify financial institutions.
5. Seek outside counsel.
   Consider asking the following questions to the outside counsel you engage:
   • Which state laws apply to the incident?
   • Would the incident be considered a "data security breach" under those laws?
   • Am I required to notify consumers of the incident?
   • Am I required to notify the government of the incident?
     • If so, which state or federal government agencies must be notified?
     • If not, should I voluntarily notify my local law enforcement, or the FBI?
   • Am I required to notify the consumer reporting agencies (e.g., Experian, Equifax, and TransUnion)?
   • Am I required to notify the payment card companies of the incident?
   • If notification is required, how much time do I have to issue those notices?
   • What is required if the affected individuals live abroad?
   • What information is required in the notification letter?
   • How and in what format should the notification letter be sent?
6. Notify affected customers.
   Advise them of:
   • What occurred
   • When it occurred
   • The specific steps you are taking to address the event

U.S. Legal Requirements

Federal Laws

The Gramm-Leach-Bliley Act ("GLBA") and the American Recovery and Reinvestment Act require that certain financial institutions as well as health care providers, or businesses that provide services to health care providers, notify patients and the government if the security of the personal information that they maintain is breached.
You should consult an attorney to determine if you are covered by one of these statutes.

State Laws

Almost every state and territory, including the District of Columbia, Puerto Rico, and the U.S. Virgin Islands, has enacted a "data breach notification" statute. Although statutes vary between states, data breach notification statutes generally require businesses that have personal information about residents within a state to notify those residents if someone who is not authorized acquires that information.
You should consult an attorney to determine which state data breach notification statutes apply to your business, and what the specific requirements of those statutes might be.

• GLBA Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice.
  http://www.occ.gov/news-issuances/federal-register/70fr15736.pdf
• Links to state data breach notification statutes
  www.ncsl.org/Default.aspx?TabId=13489

Data Security Guide:Spotting Identity Theft

Identity theft can take many different forms. For example, a criminal might try to use another person’s name and address when establishing an account with a small business that offers delayed (30-days) billing after the date of sale. Or a criminal might try to log-in to another customer’s account and make transactions without their authorization. Or another might use a stolen credit card number to buy products and services.

Getting Started

For a small business, combating identity theft is a three-step process, which needs to be put into action before an event occurs:

1. Identify types of suspicious behavior.
   Identify in advance what constitutes suspicious behavior. This is often referred to as the "red flags" of identity theft.
2. Develop policies that will detect suspicious events early — and train your employees.
   Put policies into place that will help you and your employees identify a red flag and catch suspicious events early...or even as they occur.
3. Respond to suspicious behavior.
   Detecting red flags needs to be matched with potential action plans. The type of action will depend on the type of red flag...and the risk that red flag could lead to identity theft.
4. Write it down. Type up the lists you just created, above:
   1. The red flags that could affect your small business,
   2. The ways in which your small business will detect suspicious events, and
   3. How your business will respond to suspicious behavior.

Checklists

1. Identify types of suspicious behavior.
   Although red flags differ among businesses and industries, the following types of red flags are common to most small businesses:
   • A customer reports that they have seen suspicious activity in one of their accounts.
   • A customer opens a new account that contains suspicious elements.
   • A customer presents you with suspicious documents (e.g., altered ID card, different addresses on different forms of ID, a PO Box as a home address).
   • You (or your employees) notice unusual activity relating to a customer's account.
2. Develop policies that will detect suspicious events early — and train your employees.
   Policies will differ depending on your business and your industry, but the following are examples of ways you can train your employees, which will become the basis for your Red Flags Policy:
   • Train about types of red flags they might see when a customer opens an account.
   • Train about types of red flags they might see when a customer orders a product/service.
   • Train about types of red flags they might see on an existing account.
3. Respond to suspicious behavior.
   Here are some possible action plans, depending on the circumstances:
   • Report the red flag event to the police or to other law enforcement agencies, such as the Federal Trade Commission or your state attorney general's office.
   • If the red flag involves Internet sales you can report the event to the FBI's Internet Crime Complaint Center www.ic3.gov.
   • Alert your customer that suspicious behavior has been observed on their account.
   • Refuse to complete a transaction until the suspicious event can be explained.
   • Request that your customer provide additional documentation to verify that they are who they say they are.
   • Request that your customer explain the suspicious activity.

Write it down.

• Develop a written policy and update it periodically — at least once a year.
• Share your policy with all of your employees, and use it to help train them on how to detect and respond to identity theft.

U.S. Legal Requirements

The Fair and Accurate Transactions Act ("FACTA") requires "financial institutions" and "creditors" that maintain “covered accounts” for their customers to create a written program to detect, prevent, and mitigate identity theft.
The Federal Trade Commission has published a legal rule, called the Red Flags Rule, to provide small businesses with guidance on how to comply with FACTA. In May 2013, the Commission released a new guide entitled Fighting Identity Theft with the Red Flags Rule: A How-To Guide for Business(the “Guide”) to help businesses and organizations determine whether they are subject to the Red Flags Rule and how to meet the Rule’s requirements. The FTC’s Guide includes information regarding what types of entities must comply with the Red Flags Rule, a set of FAQs, and a four-step process to achieve compliance.
Although you may not think that your business is either a "financial institution" or a "creditor," the FTC considers certain businesses that allow customers to defer payment when they receive goods or services to be “creditors”. For example, businesses that regularly obtain or use consumer reports in connection with credit transactions; or furnish information to consumer reporting agencies in connection with such transactions; or advance funds to or on behalf of a person under certain circumstances, are considered “creditors” under the Rule. If your business could be considered to be a “creditor”, you should check to see if any of your customer accounts may be “covered accounts” under the Rule.
Under the Rule, businesses with “covered accounts” must put in place a Red Flag program that:

• Includes reasonable policies and procedures to identify the “red flags” of identity theft in the day-to-day operations of the business.
• Is designed to detect the red flags of identity theft known to the business.
• Sets out the actions the business will take upon detecting red flags.
• Is re-evaluated periodically.

If you think your business may be covered by the Red Flags Rule, you may wish to consult an attorney to determine whether you are covered, whether you are required to have a written policy (a "Red Flags Policy"), and if necessary, whether your Red Flags Policy complies with the Red Flags Rule.

Data Security Guide:Communicating Your Data Security Program to Your Customers

Telling your customers that you have a data security policy in place will both build their trust and differentiate you from your competitors.

Getting Started

There is a sensible line to walk when communicating your data security plan. You need to a) Decide how much you communicate (too much detail will help criminals); b) Ensure your communication is accurate, and c) Put what you promote into action on an ongoing basis.

1. Information to share.
2. Information NOT to share

Checklists

1. Information to share.
   • Obtain a third-party seal that verifies your small business uses an appropriate level of security to protect your website, or your Internet transactions. This can be a visual tool to communicate to customers that you have qualified for a level of certification — which is something some customers may look for.
   • Make sure that whatever information you communicate to your customers about how you protect their data is accurate and is up-to-date. For example, if you tell consumers that you keep their information on computers that you own, and then you contract with another company to provide off-site computer storage space, make sure that you reflect your new practices in your public policies.
   • Tell customers what you will do in the event that you discover that their information has been lost or stolen. 
2. Information NOT to share.
   • DO NOT share detailed information about your security systems. Remember, criminals see what your customers see, and they can use public information about your security systems to evade them (e.g., the encryption software you use, or where you store documents).
   • DO NOT tell customers that there is no risk of ID Theft, or that their information is “100% safe.” No matter how hard you try to protect customer information, there is always a chance that someone may obtain and misuse it.
   • DO NOT guarantee or promise that customers’ information can never be lost or stolen unless you tell customers what you will do if that promise is broken.

U.S. Legal Requirements

Generally small businesses are not required under federal or state law to make public how they protect information.
If a small business chooses to publish information concerning how it protects the sensitive personal information that it keeps, how it spots identity theft, how it responds when data is lost or stolen, or how it disposes of data, the Federal Trade Commission Act and consumer protection statutes in almost every state and territory prohibit the business from making false or deceptive statements.

Data Security Guide:Disposing of Data — Do It Responsibly

It is generally a good idea to make sure that any document, whether it is a paper document or an electronic document, is completely destroyed when you no longer need it if it contains information about you or your business, any of your customers, potential customers, or employees. Here are some general and easy-to-follow guidelines.

1. Destroying paper records yourself
2. Destroying electronic records yourself
3. Hiring a company

Checklists

Destroying Paper Records Yourself

• Shred all sensitive paper documents. Never just deposit them in the trash or dumpster.
• Ideally, use a shredder that cross-cuts, confetti-cuts, or particle-cuts.

Destroying Electronic Records Yourself

What works

• Use data wiping software. It removes information by writing new, meaningless information on top of old information.
• Use specialized shredders to destroy CDs and DVDs.
• "Magnetically degauss" hard drives in old computers. Magnetic degaussing uses extremely strong magnets to remove the magnetic encoding that stores data. Although degaussing machines are expensive, many companies charge less than $10 to degauss a hard drive.

What does not work

• Breaking an old computer. Breaking an old computer does not mean that you are breaking the hard drive where data is stored. Although it is possible to remove the hard drive and then physically destroy it (e.g., drilling a hole through it) this can be time-consuming and dangerous if you don't have the right equipment.
• Microwaving CDs and DVDs. Although microwaving a CD or DVD destroys the data on the disk, it may also release toxic fumes into your microwave or cause a fire.
• Placing it in the "Recycle Bin" on your desktop, or clicking "Delete." It may disappear from your screen, but it still exists and could be recovered by a computer expert.

Hiring a Disposal Company

• Consider using a certified disposal company. The National Association for Information Destruction (NAID) audits their member companies for compliance with the association's standards.
• Ask if they have been independently audited or certified, and request a copy of the audit or certification.
• Ask for several references and call the references.
• Ask for a signed agreement that explains the company's procedures for destroying documents.

U.S. Laws Governing Data Disposal

Federal Laws

The Fair Credit Reporting Act (FCRA) and the Federal Trade Commission's Rule concerning the Disposal of Consumer Report Information and Records (the Disposal Rule) requires small businesses that obtain consumer information from consumer reporting companies (e.g., Equifax, Experian, or TransUnion) to take "reasonable measures" to properly dispose of that information. Health care providers and financial institutions may have additional obligations to destroy consumer information under the Health Insurance Portability and Accountability Act (HIPAA) and the Gramm-Leach-Bliley Act (GLBA).


State Laws

Approximately 24 states have statutes that require small businesses to dispose of records that contain personal information. Similar to the Disposal Rule, the majority of these statutes require small businesses to take "reasonable steps" when destroying records. Some of the state statutes only apply to specific types of small businesses, such as health care providers, financial institutions, or tax preparers. You should consult an attorney to determine whether any state laws apply to your business

Data Security Guide:Becoming ‘PCI Compliant’ If You Accept Credit Cards

Nearly all businesses today accept credit and debit cards as a form of payment. Because sensitive data is collected in connection with these payments, the payment card industry has developed a comprehensive standard to help ensure the security of cardholder account data. This standard is known as the Payment Card Industry Data Security Standard or "PCI DSS," and is managed by the PCI Security Standards Council. The PCI DSS applies to all businesses that store, process or transmit cardholder data, and is enforced by the founding members of the PCI Security Standards Council — Visa Inc., American Express, Discover Financial Services, JCB International, and MasterCard Worldwide.

Getting Started

Ask your merchant bank or third party payment processor to assist you in determining how your business can best comply with the PCI DSS. Data security requirements may vary depending on the type of payment card processing device used, the sophistication level of your payment systems, and the cardholder information you collect and store. For example, businesses that use only imprint machines or standalone dial-out terminals — and do not electronically store cardholder data — need only comply with a subset of the PCI DSS requirements. Businesses using payment systems connected to the Internet or integrated payment applications (i.e., PC-based software applications) must ensure these systems are protected against computer-based attacks.

Checklists

All businesses that accept credit and debit cards using an integrated payment application and/or e-commerce website should follow these general guidelines.

DOs

• Do regularly monitor and test networks/systems that have payment card data.
• Do implement and enforce a company Information Security Policy.
• Do install and keep up-to-date, a firewall that protects cardholder data stored within company systems.
• Do assign every employee with computer access a unique ID and use a robust password (e.g., mix of letters, numbers, and symbols), which is changed frequently (every 45-60 days).
• Do restrict physical access to company systems and records with cardholder data to only those employees with a business “need-to-know.”
• Do encrypt cardholder data if transmitting it over wireless or open, public networks.
• Do use and regularly update anti-virus software.
• Do have secure company systems and applications (e.g., good and frequent process to update all computers with necessary patches, process for identifying system/application vulnerabilities, etc.).
• Do ensure any e-commerce payment solutions are tested to prevent programming vulnerabilities like SQL injection.
• Do use a Payment Application Data Security Standard (PA-DSS) compliant payment application listed on the PCI Security Standards Council website at https://www.pcisecuritystandards.org/security_standards/vpa/.
• Do verify that any third party service provider you use who handles cardholder data has validated PCI DSS compliance by visiting the PCI Security Standards Council website at www.pcisecuritystandards.org.

DON'Ts

• Don't store magnetic stripe cardholder data or the CVV or CVC code (the additional security number on the back of credit cards) after authorization.
• Don't use vendor-supplied or default system passwords or common/weak passwords.
• Don't store cardholder data in any systems in clear text (i.e., unencrypted).
• Don't leave remote access applications in an "always on" mode.

Data Security Guide:Monitoring & Transmitting Financial Data — Do It Securely

Online banking is a useful tool to help small businesses quickly and conveniently track financial information, pay bills, and pay employees. However, data thieves are now targeting small business owners — and their employees — to get access to their online banking credentials and accounts so that they can make unauthorized money transfers. A small business can protect itself against increased liability on its financial transactions by using strong procedures to secure the credentials they use to access their bank accounts.

Getting Started

The following guidelines will help you protect the computers you use to access your bank accounts and your online access credentials.

1. Initiate a "dual control" payment process with your bank and employees.
   Ensure that all payments are initiated from your bank accounts only after the authorization of two employees. One employee will authorize the creation of the payment file and a second employee will be responsible for authorizing the release of the file. This process should be in place regardless of the type of payment being initiated...including checks, wire transfers, fund transfers, payroll files, ACH payments, etc.
2. Have dedicated workstations.
   Restrict the use of certain workstations and laptops to be utilized solely for online banking and payments, if possible. For example, a workstation or laptop used for online banking should not be also used for web browsing or social networking.
3. Use robust authentication methods and vendors.
   Make sure your financial service providers allow for "multi-factor authentication." This means that you need more than just a username and password to access your account.
4. Update virus protection and security software.
   Ensure that all anti-spyware, anti-malware, and security software and mechanisms are robust and up-to-date for all computer workstations and laptops used for online banking and payments. Implement a process to periodically confirm they remain up-to-date. Security patches are often available via automatic updates.
5. Reconcile accounts daily.
   Monitor and reconcile accounts daily against expected credits and withdrawals. If you see any kind of unexpected activity on your account, notify your financial institution immediately.

Checklists

1. Initiate a "dual control" payment process with your bank and employees.
2. Have dedicated workstations.
   
   • Lock down these workstations when not in use...even for short periods of time.
   • Do not use public computers — such as at the public library, hotel business centers or airport computer terminals — to access online banking.
3. Use robust authentication methods and vendors.
   
   In addition to passwords and PINs:
   • Each user should have their own password — do not allow several users to share the same password.
   • Use complex passwords — ones that contain a combination of numbers, letters and/or symbols.
   • Consider using an additional authentication tool, such as a token or a smart card.
   • Each user should change their password frequently — approximately every 45-60 days.
4. Update virus protection and security software.
   • Do not respond to emails or open attachments...unless you were expecting the communication. Phishing scam emails can come from both unrecognized and recognized sources.
   • You won’t ever receive an authentic email asking for your online banking credentials.
   • If something appears unusual or you receive an email requesting your online banking credentials, call your bank, but don’t click on any links or use any information from the email, as it may be a phishing email.
5. Reconcile accounts daily.
   
   • Utilize bank account features, such as automated payment filters and other alerts that show unexpected activity on your accounts.

Data Securuty Guide:Securing Personal Data — Start with the Basics

Customers expect that every business — large or small — that collects their personal information will protect it. Beyond customer expectations, there’s the law. Depending on your type of business and the states in which your customers reside, you may be legally required to protect the personal information you collect.

Getting Started

First, determine what makes sense for your type of business. This will be based on the type of data that you collect and store, and the kind of resources you have managing that data.
If your small business keeps information about customers and employees in several formats (e.g., on paper, on computers, and in the cloud), you should sit down with a team of your employees — an IT person, office manager, etc. — and discuss these issues together to make sure you consider all viewpoints.

1. Inventory the TYPES of data you collect, store and/or transmit.
2. Inventory HOW you store your data.
3. Inventory WHERE you store your data for each type and format of customer information.
4. Inventory HOW DATA IS MOVED and WHO HAS ACCESS to it. Take into consideration your type of business, and the stationary and portable tools your employees use to do their jobs. This is a very important part of the inventory process, as it will help you begin to identify the potential ways that personal data could be inadvertently disclosed. If you think you need outside help to identify potential leak points, consider consulting with an IT security expert and/or the bank or processor that provides your merchant account services.
5. Inventory the DATA CONTROLS YOU HAVE IN PLACE.
6. Evaluate COSTS versus BENEFITS of different security methods. Brainstorm different types of security procedures and think about whether they make sense for the type of information you maintain, the format in which it is maintained, the likelihood that someone might try to obtain the information, and the harm that would result if the information was improperly obtained.
7. Write it down. Type up the checklists you’ve just created, the security measures you are taking, and an explanation on why these security measures make sense.
   
   

   Checklists

   1. Inventory the TYPES of data you collect, store and/or transmit.
      • Names
      • Physical addresses
      • Residential phone numbers
      • Mobile phone numbers
      • Email addresses
      • Payment card information
      • Account numbers
      • Invoice numbers
      • Social Security numbers
      • Drivers license numbers
      • Business identification numbers
      • Types and amounts of transactions
8. Inventory HOW you store your data.
   • Paper invoices
   • Paper mailing lists
   • Paper customer files
   • Paper order requests
   • Email
   • Databases
   • Spreadsheets
   • Contracts
   • Business plans
   • Financial reports
9. Inventory WHERE you store your data for each type and format of customer information.

   Physical storage sites

   • Desk drawers
   • Filing cabinets
   • Mail room
   • Home offices

   Electronic storage sites

• Desktop computers
• Laptop computers
• Servers
• Smartphones
• Tablets
• USB/thumb drives
• CDs, DVDs
• Online hosts/cloud providers
10. Inventory HOW DATA IS MOVED and WHO HAS ACCESS to it. Take into consideration your type of business and the desktop and mobile tools your employees use to do their jobs. This is an important part of the inventory process, as it will help you begin to identify the potential ways that sensitive data could be inadvertently disclosed. If you think you need outside help to identify potential leak points, consider consulting with an IT security expert and/or the bank or processor that provides your merchant account services.

SAP Security: Profiles in SAP

SAP profiles are operating system files that contain instance setup information. SAP Systems can consist of one or more instances. Individual setup parameters can be customized to the requirements of each instance.
Start Profiles
When you start an SAP instance on a host, the start profile defines which SAP services are started (message server, dialog, gateway or enqueue process. for example). The startsap program is responsible for starting these service processes, and it uses a start profile to begin the startup process.
The processes that can be started include:

• Application server

• Message server

• SNA Gateway

• System log send demon

• System log receive demon

Default Profiles
If you want to assign the same parameter value for all application servers (such as the name of the database host, or the host on which the message server is running), enter it in the default profile.
You cannot choose a name for the default profile. It is always called DEFAULT.PFL . Default profiles are also called system profiles.
Instance Profiles

nstance profiles provide an application server with additional configuration parameters to complement the settings values from the default profile. Typically, these parameter settings adapt the instance according to the desired resources. They also define the available instance resources (main memory, shared memory, roll memory and so on), and how to allocate memory to the SAP application buffers.

You can choose any name for an instance profile. The SAP naming convention is as follows: _ or __ .

To start application servers on several computers using identical parameter settings, you can use a single instance profile. It is generally not necessary for each application server to have its own instance profile. Instance profiles are also called system profiles.

SAP Security: What authorization are required to create and maintain user master records?

The following authorization objects are required to create and maintain user master records: S_USER_GRP: User Master Maintenance: Assign user groups S_USER_PRO: User Master Maintenance: Assign authorization profile S_USER_AUT: User Master Maintenance: Create and maintain authorizations

SAP Security : SU24 Concept

•Transaction SU24 maintains the USOBT_C and USOBX_C tables. These tables hold the relationships between the particular transaction and its authorization objects. It is possible to add or subtract the checks performed in the transaction by changing the appropriate flag.
•The benefit of transaction SU24 occurs when transactions are added to or deleted from Role Groups using the Profile Generator.
•When new transactions are added, the Profile Generator will add all authorization values maintained in SU24 for the transaction(s).
•When deleting transaction the Profile Generator will remove all authorization values that are maintained in SU24 for the transaction.
•Activities performed:
•Check/Maintain Authorization Values
•Addition of Authorization Object to tcode
•Deletion of Authorization Object from tcode

Check Ind.	Proposal	Meaning	Explanation
Check	YS	Check /Maintained	The object will be inserted along with the values in the role.  The object will be checked along with the values during runtime of the transaction.
Check	NO	Check	This object will not be inserted into the roles.  A check on the object along with the values will be done during the runtime of the transaction
Do not Check	NO	Do Not Check	The object will not be inserted into the roles and there will not be any check performed during runtime of the transaction

Status Texts for authorizations
•Standard: All field values in the subordinate levels of the hierarchy are unchanged from the SAP defaults
•Maintained: At least one field in the subordinate levels of the hierarchy was empty by default and has since been filled with a value
•Changed: The proposed value for at least one field in the subordinate levels of the hierarchy has been changed from the SAP default value.
•Manual: You maintained at least one authorization in the subordinate hierarchy levels manually (it was not proposed by the Profile Generator).

Effect of SU24 changes in Role Groups
•Authorization objects are maintained in SU24 for a particular transaction code. When a transaction code is added to role, only the authorization objects having check as check indicator value and yes as proposal value, maintained for that tcode will be added into the role group.
•
1)  Adding Tcodes to a role
When a new Tcode is added to a role
•When a new tcode is added to a role, going in either change authorization data or expert mode provides the same result. All the authorizations maintained for the tcode at SU24 level is added to the role.

•The program adds new standard authorizations for  objects in the roles If the authorization default values contain objects that
were previously not existing
Or only had authorizations in the status Changed or Manual

•A new standard authorization is not included
if the authorization fields contain identical authorizations in the status Standard in both authorizations, and the fields maintained in the old authorizations are empty in the new standard authorization.
If there were already authorizations in the status Maintained (active or inactive) or Inactive Standard before the merge, the program compares the values and the maintenance status of all authorization fields to determine whether new standard authorizations must be extended.
Changing SU24 values for a tcode
If the authorization data is changed for any tcode in SU24 and tcode is already present in the role, then going in the expert mode with option “read old data and compare with new data” will only reflect the additional changes. Change authorization data will not pull the new data for the tcode maintained at SU24 level

2) Removing Tcodes from the role
When you remove transactions from the role menu, this has the following effect on the authorizations.
•A standard authorization for which the associated transaction was removed from the role menu is removed during the merge, unless at least one other transaction that remains in the menu uses the same authorization default value. This applies both for active and inactive standard authorizations.
•Authorizations in the statuses Changed and Manual are not affected by the merge. They are therefore always retained.

IIS AppCmd Quick Reference

1. Add Site
appcmd add site /name:MySite /bindings:http://*:80 /physicalpath:”d:\MySitePath”
2. Add App Pool
appcmd add apppool /name:MyAppPool /managedRuntimeVersion:v4.0 (e.g. targeting .NET 4.0)
3. Set App Pool Credential
appcmd set config /section:applicationPools /[name='MyAppPool'].processModel.identityType:SpecificUser /[name='MyAppPool'].processModel.userName:MyDomain\MyAccount /[name='MyAppPool'].processModel.password:MyAccountPassword
4.Add App
appcmd add app /site.name:"MySite" /path:/MyApp /physicalpath:"d:\MySitePath\MyApp"
5. Assign/Change App Pool to an App
appcmd set app "MySite/MyApp" /applicationpool:MyAppPool
6. List (App, Site, AppPool, etc.)
appcmd list app
appcmd list site
appcmd list apppool
7. Enable/Disable Anonymous Authentication (True to Enable, False to Disable)
appcmd set config "MySite/MyApp" -section:system.webServer/security/authentication/anonymousAuthentication /enabled:"True" /commit:apphost
8. Enable Windows Authentication (True to Enable, False to Disable)
appcmd.exe set config "MySite/MyApp" -section:system.webServer/security/authentication/windowsAuthentication /enabled:"True" /commit:apphost
9. Change Windows Authentication Providers (NTLM or Negotiate)
appcmd set config MySite/MyApp -section:system.webServer/security/authentication/windowsAuthentication /~providers /commit:apphost (clear provider list)
appcmd set config MySite/MyApp -section:system.webServer/security/authentication/windowsAuthentication /-providers.[value='NTLM'] /commit:apphost (set to NTLM)
appcmd set config MySite/MyApp -section:system.webServer/security/authentication/windowsAuthentication /+providers.[value='Negotiate'] /commit:apphost (set to Negotiate)
10. Add Custom Header – for example, nosniff header or IE 7 compatiable header
appcmd set config MySite -section:system.webServer/httpProtocol /+customHeaders.[name='X-Content-Type-Options',value='nosniff'] /commit:apphost
appcmd set config MySite -section:system.webServer/httpProtocol /+customHeaders.[name='X-UA-Compatible',value='IE=EmulateIE7'] /commit:apphost
11. Add Default Document - error if it exists already
appcmd set config "MySite/MyApp" /section:defaultDocument /+files.[value='default.asmx']
12. Delete App and Site - error if it doesn’t exist
appcmd delete app "MySite/MyApp"
appcmd delete site "MySite"
13. Delete AppPool- error if it doesn’t exist or it is used by app
appcmd delete apppool MyAppPool
14. Backup and Restore IIS Settings
appcmd add backup MyBackup
appcmd restore backup MyBackup
15. HTTPS Binding if you are using HTTP over SSL
appcmd set site /site.name:"MyApp" /+bindings.[protocol='https',bindingInformation='*:443:MySSLCertificate']

How to Remove a Credit Card From an iTunes Account

Apple wants your money. And to help get it, they want your credit card information on file so that it can be easier for you to buy music, movies and apps from the iTunes store. That's why they require you to input a valid form of payment, usually a credit card, when you register for an iTunes account. But did you know it is rather easy to remove the credit card information from your account?

1. Open iTunes on your PC.
2. If not already signed in, log in to your account by choosing "Sign In" from the Store menu. (It's just to the left of Help.)
3. Once signed in, choose "View my Apple ID" from the Store menu. You may have to enter your password again.
4. In the Apple ID Summary, click on the "Edit >" link directly to the right of Payment Type. This allows you to edit your choice of payment.
5. Instead of choosing a credit card, click the "None" button. (I've highlighted it in the Photo above this article.)
6. Scroll down and choose Done from the bottom.

That's it. You now have an Apple iTunes Account with no credit card attached, which can be very handy if you want to give an iPad to your kid and make sure there is no way they can run up a large bill on it. Read on to find out how to get apps onto the iPad now that it has no credit card attached.