2013 UNC Financial Systems Conference Tackling our Financial Challenges March 17 - 19, 2013

1. 2013 UNC Financial Systems Conference Tackling our Financial Challenges March 17 - 19, 2013

2. Agenda • How do I find out who is taking payments? • Centralizing Department Payments • Policy • Process • Communications • Technology • Co-Sourcing, Integration, Security & Compliance

3. Online Payments

4. Best Practice

5. “Big Rocks” • Tuition and Fees • ERP • Hosted Solution • Policies for face-to-face payments • Cashiering • Swipe devices • Payment Plans • Enrollment process • Service (questions about account) • Red Flag Compliance

6. Best Practice

7. College Budgets Auxiliary Services Promotes college Generates revenue Community Involvement Departments • Decreased State funding • Seeking ways to generate revenue • Larger portion of budget It’s great to have departments generating some revenue…. BUT……

8. Departmental Revenues • Want it right now • Going off on their own • All over the board • Don’t involve business office • Creates extra work for business office Reconciliation nightmare!!!!!

9. Campus Departments • Parking • Theater • Events • Summer Camps • Alumni/Development • Pottery Store • Cheese Store • Merchandise Sales • Tickets

10. HOW ARE THEY DOING IT????

11. How do I find out who is taking payments? Subtitle And how they are taking them…….

12. Do a search of your website….. Awesome State University

14. Review and act upon what you find!!!

15. I know who is taking payments…….. Now what do I do ???? Centralize Campus Commerce & Department Payments

16. Centralize Campus Commerce & Department Payments • Policy • Process • Communication • Technology

17. Policy & Process • Day-to-day AND new service implementation control is in YOUR hands • Administrator establishes “order details” and interface parameters in “test” • File transfer & interfaces • HTTPS communication • Hash validation • Tools are provided for testing new pages and orders, and migrating them on your schedule

18. Value Proposition • Departments can now innovate and create revenue enhancement opportunities by selling on-line – securely! • Reduces your institutional PCI compliance burden • By design, encourages eCommerce best practices • Straightforward configuration and rapid deployment drives adoption • Reports and “End-of-Day” file support reconciliation and other production requirements • Scalability and transparency • Distribute administrative and operational support to trusted partners • Central visibility into all commerce activities

19. Centralized eCommerce Technology • Platform for campus-wide commerce support • Hosted order page with flexible data gathering capability • Geared to address common university commerce needs(product sales, simple event registration, gift processing) • Powerful – multiple usage paradigms • As basic “site” combined with payment page • As embedded payment form in another website (e.g. in an iFrame) • As a behind-the-scenes payment service (pay now button) • Versatile financial design • Flexible configuration defines reporting and settlement structure • Can be leveraged to consolidate MIDs, reduce expenses, enable “rollups”

20. Department Commerce • Front End • Demographic information • Name, rank and serial number • SSN? • Student ID? • Back end • Payment information • Account Information and card holder data • Address and zip • CVV?

21. Co-Sourcing, Integration, Security & Compliance &

22. Accept the risk Mitigate the risk Avoid the risk Transfer the risk Strategies for Compliance

23. Co-sourcing & Compliance • A Trusted Partner • Part of your overall compliance solution • Protect YOUR sensitive data • Proven track record • Knowledgeable • Customer Service focus • Reliable SICAS Summit 2011 – The Power of SUNY

24. Co-sourcing: Secure & Convenient - • Convenience • Integration with your ERP • Integration with 3rd party vendors • Campus Commerce self-service • Centralized reporting & reconciliation • Security • Core Business – PCI Level 1 Compliant Provider • Fully Hosted • Higher Ed Focused

25. Co-sourcing: Secure & Convenient - • Securing YOUR data • End-to-end encryption • Data at rest • Data in transit • Vulnerability scans • Penetration testing • Secure coding practices • Background checks • Best Practices • Redundancy • Physical Security • Value Added • Merchant Services • Compliance consulting • Forms processing

26. Third Party Vendor Integration -

27. Limiting your scope • Co-source with PCI-DSS Level 1Compliant Providers • Level 1 Providers process >300K transactions annually • Most stringent audit requirements • Prove compliance annually - (QSA) • Avoid Payment Applications that reside locally • Ensure PA-DSS compliance where this cannot be avoided • PTS Compliant Devices • Ensure PED (Pin Entry Devices) are up-to-date and compliant • Policies & Procedures • Develop AND follow them

28. Limiting your scope • Training • Develop in-house training program for anyone who handles card holder data • Self-Assessment Questionnaire (SAQ) • Complete it annually • Incident Response Plan • Identify key stakeholders • Have a plan “Compliance is a journey..not a destination” Ron King, COO, CampusGuard

29. About Nelnet Business Solutions -

30. Contact Brian Barry, Regional Vice Presidentbrian.barry@nelnet.net - 888.867.8290 www.campuscommerce.com