Sonoma State University

Cardholder

The customer to whom a payment card has been issued or the individual authorized to use the card.

Cardholder Data

All personally identifiable data about the cardholder (i.e., account number, expiration date, cardholder name, address, telephone number, social security number, etc.

Card-Validation Code or Value

Refers to either (1) magnetic-stripe data or (2) printed security features. Data element on a card’s magnetic strip that uses a secure process to protect data integrity on the strip, and reveals any alteration or counterfeiting. The following list provides the terms for each card brand:

• CAV – Card Authentication Value (JCB payment cards)
• CVC – Card Validation Code (MasterCard payment cards)
• CVV – Card Verification Value (Visa and Discover payment cards)
• CSC – Card Security Code (American Express)

For Discover, JCB, MasterCard, and Visa payment cards, the second type of card verification value or code is the rightmost three digit value printed in the signature panel area on the back or the card. For American Express payment cards, the code is a four-digit un-embossed number printed about the PAN on the face of the payment card. The code in uniquely associated with each individual piece of plastic and ties the PAN to the plastic. The following provides an overview:

• CID – Card Identification Number (American Express and discover payment cards)
• CAV2 – Card Authentication Value 2 (JCB payment cards)
• CVC2 – Card Validation Code 2 (MasterCard payment cards)
• CVV2 – Card Verification Value 2 (visa payment cards)

Encryption

The process of converting information into an unintelligible form to anyone except holders of a specific cryptographic key. Use of encryption protects information between the encryption process and the decryption process against unauthorized disclosure.

Magnetic Stripe Data (Track Data)

Data encoded in the magnetic stripe use for authorization during payment transaction.

Merchant

For the purposes of the PCI DSS and this policy, a merchant is defined as any university department or other entity that accepts payment cards bearing the logos of any for the five members of PCI SCC (American Express, Discover, JCB, MasterCard or Visa) as payment for goods, services, or donations.

Payment Card

Any payment card/device that bears the logo of American Express, Discover Financial Services, JCB International, MasterCard Worldwide, or VISA, Inc.

Payment Card Account Change

Any change in the payment account including, but not limited to:

• the use of existing payment card accounts for new purposes;
• the alteration of business processes that involve payment card processing activities;
• the addition or alteration of payment systems;
• the addition or of relationships with third-party payment card service providers, and
• the addition or alteration of payment card processing technologies or channels.

Payment Card Industry (PCI) Data Security Standard (DSS)

A multi-faceted security standard that includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures.