Specifically, here's some guidance to answer some of these questions:

1. Generally, how does your business store, process and/or transmit cardholder data?: Mention using Bluefin with PatronManager
2. Briefly describe the environment and/or systems covered by this assessment: Mention your different Bluefin devices (i.e. SREDKeys, PAX devices), your Public Ticketing Site, and your Donation Forms in PatronManager that use a Bluefin iFrame

To get your public site URL, use your Public Ticketing Site (PTS) URL, then remove everything after .com.

So, for example, if your PTS URL is

https://superherotheatre.my.salesforce-sites.com/ticket/#/

then for this page, enter the URL

https://superherotheatre.my.salesforce-sites.com

If you're using a version of our policies and procedures template, then select Yes.

Since this is required by Bluefin's P2PE Manager, this is accurate.

Since this is required by Bluefin's P2PE Manager, this is accurate.

If you're using a version of our policies and procedures template, then select No.

If you're using a version of our policies and procedures template, then select Yes.

If you're using a version of our policies and procedures template, then select Yes.

If you're using a version of our policies and procedures template, then select Yes.

If you're using a version of our policies and procedures template and Bluefin's P2PE Manager, you should be set here.

If you're using a version of our policies and procedures template, then select Yes.

If you're using a version of our policies and procedures template, then select Yes.

If you're using a version of our policies and procedures template, then select Yes.

Since Bluefin devices have anti-tamper features built in, select Yes.

If you run into some tricky questions, check our SAQ explanation section below!

• "Is data storage amount and retention time limited to that required for legal, regulatory, and/or business requirements?"
  • Select: N/A
  • Reason: Since Bluefin and PatronManager never store cardholder data, you're automatically limiting your data storage properly.
• "Are there defined processes in place for securely deleting cardholder data when no longer needed for legal, regulatory, and/or business requirements?"
  • Select: N/A
  • Reason: You do have processes in place - that is, Bluefin and PatronManager never store cardholder data, so you don't ever need to delete it.
• "Are there specific retention requirements for cardholder data?"
  • Select: N/A
  • Reason: Again, by using Bluefin and PatronManager, your retention requirements are inherently 'cardholder data should never be held'.
• "Is there a quarterly process for identifying and securely deleting stored cardholder data that exceeds defined retention requirements?"
  • Select: N/A
  • Reason: As you might have guessed, your quarterly process is that you never store cardholder data.
• "Does all stored cardholder data meet the requirements defined in the data-retention policy?"
  • Select: N/A
  • Reason: It does meet those requirements - by virtue of not existing.
• "For all paper storage, the card verification code or value (three-digit or four-digit number printed on the front or back of a payment card) is not stored after authorization?"
  • If you're using a version of the policies and procedures template we've provided,  then you should be destroying any hard copies that contain card information after authorization.
• "Are security policies and operational procedures for protecting stored cardholder data: (a) Documented (b) In use (c) Known to all affected parties?"
  • If you're using a version of the policies and procedures template we've provided, and disseminated it correctly amongst your staff, you've documented and circulated your policy to not store cardholder data.

• "Are all media physically secured (including but not limited to computers, removable electronic media, paper receipts, paper report, and faxes)?"
  • If you do have donation or ticket order forms with credit card data in your office, are they locked up (e.g. in a filing cabinet)?
• "Is all media destroyed when it is no longer needed for business or legal reasons?"
  • After you've entered payment information contained on a paper order form into PatronManager, do you dispose of the order forms?
• "Are hardcopy materials cross-cut shredded, incinerated, or pulped so that cardholder data cannot be reconstructed?"
  • When you dispose of order forms, do you do so via one of the methods above?  Here, they want to make sure you're not simply throwing the order forms away, or tossing them in a recycle bin.
• "Are storage containers used for materials that contain information to be destroyed secured to prevent access to the contents?"
  • If you keep a "To Shred" folder in your office, is that folder locked up (e.g. in a filing cabinet)?
• "Do policies and procedures require that a list of such devices be maintained?"
  • Select: Yes
  • Reason: The devices they're referring to here are your Bluefin P2PE card readers.  Bluefin is pretty airtight on the security of their card readers, and requires you to register your devices on their P2PE Manager portal.  
    By virtue of using Bluefin, you have policies and procedures that require you to maintain a list of your P2PE devices.
• "Do policies and procedures require that devices are periodically inspected to look for tampering or substitution?"
  • Select: Yes
  • Reason: An annual inspection of your card readers is required via Bluefin's P2PE Manager, so by using Bluefin, you have these policies in place.
• "Do policies and procedures require that personnel are trained to be aware of suspicious behavior and to report tampering or substitution of devices?"
  • The policies and procedures template we've provided includes mandatory training for suspicious behavior and how to report it.  If you're using a version of that template, you have these policies in place.
• "Does the list of devices include the following? (a) Make, model of device (b) Location of device (for example, the address of the site or facility where the device is located) (c) Device serial number or other method of unique identification"
  • Select: Yes
  • Reason: Again, Bluefin requires you to enter this information into P2PE Manager to even accept payments on your card readers - so yes, your list of devices does include this information.
• "Is the list accurate and up to date?"
  • Select: Yes
  • Reason: Bluefin requires you to update your list of devices in P2PE Manager when you purchase new devices or dispose of old ones - so yes, your list of devices is up to date.
• "Is the list of devices updated when devices are added, relocated, decommissioned, etc.?"
  • Select: Yes
  • Reason: As stated above, Bluefin requires you to update your list of devices in P2PE Manager when you purchase new devices or dispose of old ones.
• "Are device surfaces periodically inspected to detect tampering (for example, addition of card skimmers to devices), or substitution (for example, by checking the serial number or other device characteristics to verify it has not been swapped with a fraudulent device) as follows?"
  • Select: Yes
  • Reason: An annual inspection of your card readers is required via Bluefin's P2PE Manager, so by using Bluefin, you are required to inspect your card readers.
• "Are personnel aware of procedures for inspecting devices?"
  • The policies and procedures template we've provided includes mandatory training on how to spot potential tampering, and how to report it.  If you're using a version of that template, your personnel should be aware of what to look for.
• "Do training materials for personnel at point-of-sale locations include the following? (a) Verify the identity of any third-party persons claiming to be repair or maintenance personnel, prior to granting them access to modify or troubleshoot devices. (b) Do not install, replace, or return devices without verification. (c) Be aware of suspicious behavior around devices (for example, attempts by unknown persons to unplug or open devices). (d) Report suspicious behavior and indications of device tampering or substitution to appropriate personnel (for example, to a manager or security officer)."
  • They want to make sure your personnel can tell an actual service provider for your P2PE card readers and someone trying to pose as one.  
  • The policies and procedures template we've provided includes mandatory training for how to make this distinction, and how to report suspicious persons or behavior.  If you're using a version of that template, your personnel should be aware of what to look for.
• "Have personnel at point-of-sale locations received training, and are they aware of procedures to detect and report attempted tampering or replacement of devices?"
  • As stated above, the policies and procedures template we've provided includes mandatory training for how to identify and report suspicious persons or behavior.  If you're using a version of that template, your personnel should be aware of what to look for.
• "Are security policies and operational procedures for restricting physical access to cardholder data: (a) Documented (b) In use (c) Known to all affected parties?"
  • The policies and procedures template we've provided includes mandatory training for keeping unauthorized personnel away from your P2PE card readers.  If you're using a version of that template, your personnel should be aware of what to look for.

• "Is a security policy established, published, maintained, and disseminated to all relevant personnel?"
  • The policy they're referring to would be your version of the policies and procedures template we've provided.
• "Is the security policy reviewed at least annually and updated when the environment changes?"
  • We recommend that you review your policy prior to answering this questionnaire, so it should be reviewed at least annually. You can then use the date you reviewed this policy for the Last completion date.
  • They're also asking if, when something about the way you accept credit card payments changes, you also update your policies and procedures (e.g. "At the Alfred F. Small theatre, all credit card transactions are to be run through SREDKey device 1 or 2.  Never transport SREDKey 3 to the Alfred F. Small theatre.").
• "Do security policy and procedures clearly define information security responsibilities for all personnel?"
  • The policies and procedures template does include a baseline of security responsibilities for any personnel handling credit card payments or cardholder data.  If you have specific security responsibilities for specific roles at your organization, you should add them to your policies and procedures.
• "Establishing, documenting, and distributing security incident response and escalation procedures to ensure timely and effective handling of all situations?"
  • Is there someone at your organization responsible for dealing with any security incidents (e.g. reporting potential device tampering to Bluefin)?
• "Is a formal security awareness program in place to make all personnel aware of the cardholder data security policy and procedures?"
  • Have you properly disseminated your security policies and procedures, and/or had a meeting with your staff to review those policies and procedures?  When a new staff member joins your team, are they properly trained on your security policies and procedures?
• "Is a list of service providers maintained, including a description of the service(s) provided?"
  • Select: Yes
  • By virtue of your contract with PatronManager and Bluefin, you maintain a list of service providers like the one they're referring to.
• "Is a written agreement maintained that includes an acknowledgement that the service providers are responsible for the security of cardholder data the service providers possess or otherwise store, process, or transmit on behalf of the customer, or to the extent that they could impact the security of the customer's cardholder data environment?"
  • Select: Yes
  • By virtue of your contract with PatronManager and Bluefin, you maintain a written agreement like the one they're referring to.
• "Is there an established process for engaging service providers, including proper due diligence prior to engagement?"
  • Select: Yes
  • As long as you're not calling someone besides PatronManager (and by extension, Bluefin) to service your P2PE card readers, you have an established process like the one they're referring to.
• "Is a program maintained to monitor service providers' PCI DSS compliance status at least annually?"
  • Here, they're asking you to check that Bluefin is PCI compliant once a year.  We've included this in our policies and procedures template.
• "Is information maintained about which PCI DSS requirements are managed by each service provider, and which are managed by the entity?"
  • Select: Yes
  • Bluefin is responsible for:
    • Providing a P2PE solution for accepting credit card payments
    • Safe handling of cardholder data transmitted through their P2PE card readers
  • Your organization (the "entity") is responsible for:
    • Safe and secure procedures when handling credit card transactions and/or cardholder information
    • Custody and inspection of your P2PE devices
    • Reporting and responding to potential security breaches
• "Has an incident response plan been created to be implemented in the event of a system breach?"
  • The policies and procedures template does include a suggested plan to be enacted in case of a system breach.