Subject: Re: PCI Compliance
From: "Michael B" <[email-masked]>
To: "Ryan Hafer" <[email-masked]>, "Joey Sheets" <[email-masked]>
Cc: "managers" <[email-masked]>
Date: Mon, 28 Jul 2014 16:58:02 -0400

I agree with Ryan on an annual communication regarding credit card processing.  It should be, at the very least, the presentation of the existing policy having each employee sign it (with that documentation being stored in their file).  Also I feel that it should be made part of the hiring packets for all new and/or returning employees.
As far as storing of paper copies, we probably only need to keep the current years orders.  Anything older could be shredded.  The current year could be stored in the main office in that back room.  That way it would be locked up with limited access.
Thank you,
Michael B
LLPS

From: Ryan Hafer 
Sent: Monday, July 28, 2014 4:04 PM
To: Joey Sheets 
Cc: managers 
Subject: Re: PCI Compliance

1) They talk about processing transactions at POS machines only, does that mean that we should be treating most computers in our network as such? 
2) Are we shredding all paper order stubs for LLPS and Corp after they are entered?
3) It seems like we should be holding a yearly meeting with all employees regarding not writing/storing credit card information since almost every employee handles credit card data at some point.
4) We don't store any card information on servers to the best of my knowledge.

On Mon, Jul 28, 2014 at 3:39 PM, Joey Sheets <[email-masked]> wrote:

  Managers, 

  Please read the following policy document and let me know if you have any questions or suggestions on how to best implement it.

  Thanks,
  Joey Sheets