Traditional communications that contain card holder data need security too
Information that comes in by telephone, by fax or in the post must still be handled with care. You should:
- Stay secure – carefully collect and file documents that contain cardholder information. These include forms, carbons, fax printouts and paper copies of telephoned orders.
- Lock paper away – store your documents safely after you’ve used them.
- Limit information - make sure that staff handling telephone sales ask callers only for appropriate cardholder information. It’s a good idea to agree a script.
- Monitor telephone sales calls - this reduces security risks, and ensures that staff only ask for the right information. You must inform all staff that their telephone sales calls may be monitored.
- Keep your fax machine safe – if it’s used to accept orders or cardholder data, place it where access to it is limited or even better, in a restricted area. If your fax can store images and print them out again later, restrict access at all times – you also need to make sure it’s not used by unauthorized staff.
- Keep faxed orders safe – take them off the machine as soon as possible, then store them securely.
- Know your people – if it’s right for your business, review the categories of staff, contractors, third parties, or business partners and list who are allowed to use the telephone, fax, and filing systems, or enter the areas in which these are kept.
- If it’s not secure, don’t use it – if you can’t guarantee the right level of security protection for a system (such as a shared fax), you must not use it to handle cardholder information.
