In compliance with the Payment Card Industry Data Security Standards (PCI DSS), the Bank Card Committee has developed Western's Security Breach Protocol and Western's Post-Reporting Incident Response Form. These documents must be followed in the case of a suspected bank card information or system breach.
The Security Breach Protocol gives Western Merchants the proper procedures to follow in reporting a suspected breach of their PCI environment. The Security Breach Incident Form must be completed and forwarded to the Bank Card Committee after the incident has been properly reported.
Through Western's continued commitment to PCI compliance, the Security Breach Protocol and procedures will be tested on an annual basis (at minimum). Through testing and incident reporting, the Bank Card Committee will continue to develop, modify and evolve the Response Plan to changes in Western's PCI environment and industry standards.
The Bank Card Committee reviews the Security Breach Response Plan on an annual basis.
The response plan should include other items such as business recovery and continuity procedures, data backup processes, roles and responsibilities, communication and contact strategies. Depending on the Merchant, these items contain different approaches and requirements.
Business Recovery and Continuity Procedures - established on Merchant by Merchant basis and documented in local policies and procedures.
Data Backup Processes - established by either local resources or Western ITS.
Roles and Responsibilities - Police Services (911) as first line of contact for theft and tampering, followed by the payment processor. Financial Services - Banking (or extension 84598) should also be notified.
Communication and Contact Strategy - if applicable, a communication plan may need to be enacted.
Currently, Police Services serve as Western's front line for all compromises after business hours. In some cases, these items can be left until business hours. In the event of a breach, end user will assess the situation and will contact the appropriate group accordingly. Theft or tampering should be reported to Police Services as soon as discovered. An incident response will automatically inform Western's Privacy Officer, CISO and Financial Services. Most other incidents can be brought straight to Financial Services in the morning of the next business day.