UC San Francisco is implementing CampusGuard to support Payment Card Industry Data Security Standard (PCI DSS) compliance activities across UCSF campus operations and UCSF Health. The engagement will provide dedicated PCI expertise and a coordinated approach to assessment and attestation activities across UCSF’s payment card environments.

For most merchant departments, no action is required at this time. Departments involved in accepting or processing payment cards — or supporting payment card environments — may be contacted as implementation begins. Here’s what CampusGuard will do, what affected teams can expect, and what happens next.

What CampusGuard will do

PCI DSS establishes security requirements for organizations that accept or process payment cards. CampusGuard is a PCI compliance services provider that will work with UCSF teams involved in accepting, processing, or supporting payment card transactions.

As part of the engagement, CampusGuard’s Qualified Security Assessor (QSA) will help confirm assessment scope and applicable PCI DSS requirements and conduct assessment activities. These may include interviews, observations, testing procedures, and evidence collection and review.

For employees and departments involved in UCSF’s payment card environments, that may mean participating in an interview or walkthrough, providing documentation or other evidence, or helping review payment card processes and controls. CampusGuard will also conduct on-site assessments with selected departments and merchant locations.

What to expect

The implementation will bring together teams across UCSF campus operations and UCSF Health to establish the CampusGuard relationship and prepare for PCI assessment and attestation activities.

While the active assessment period will include concentrated interviews and observations, the broader process also involves planning, logistics, evidence review, reporting, and, when necessary, remediation and reassessment. CampusGuard indicates that the overall assessment process generally spans two to three months.

This coordinated approach will help UCSF coordinate PCI compliance activities across payment card environments, complete required assessment and attestation activities, identify and address potential compliance gaps, and improve coordination among merchants, operational teams, technology teams, and other stakeholders — all in support of UCSF’s ongoing PCI compliance responsibilities.

What happens next

In the coming months, the UCSF Merchant Services team will work with CampusGuard to plan the implementation, identify the merchant areas and other stakeholders that will participate in PCI assessment activities, and prepare for the assessment. Those departments and stakeholders will be contacted directly with additional information, instructions, and timelines.

For questions about CampusGuard, please feel free to email [email protected].