E-commerce Standards and Procedures

The Internet is continuing to change the way business is conducted between the University of Waterloo and its customers. The University's customer services and its internal Financial and information technology departmental support infrastructure is adapting to this changing environment. The most common recent request is to accept credit card payments over the Web. The following guidelines highlight the most critical issue in providing this service, i.e. to ensure that the trusted relationship between Waterloo and its customers is conducted in the most secure, confidential and reliable method possible.

Business Plan Review and Approval Process for Proposed E-Commerce Applications

All proposed business plans involving credit card sales over the Internet for payment of goods and services must be reviewed by the UW E-commerce Committee that includes representatives from Finance, Information Systems and Technology, and others as appropriate. This group will review each proposal for intended business purpose, consistency with the University's missions, and selling department ability to support an e-commerce activity. The Financial Systems Management Committee will give final approval for all e-commerce applications.
Prior to development of an e-commerce application including those developed by outside contractors, the selling department must submit a business plan as noted above to initiate the committee review. The business plan should be completed by the selling department and sent to the Student Financials Manager in Finance (NH).
The business plan should describe the activity in appropriate detail is required. The information submitted should include the organization, purpose, clients, controls, and accounting involved. The business plan should be reviewed and approved by the appropriate departmental individuals before submission to the Committee.

Business Plan Content

Describe the products or services to be offered and the rationale for offering them via e-commerce.
Provide estimated annual transaction and dollar volume.
Describe the business process to handle the additional workload from the e-commerce function, including the accounting, maintenance, and reconciliation of general ledger accounts and the credit card operation.
Indicate whether the operation currently accepts credit cards.
Identify the hardware requirements and hardware location.
Identify the source of technical support.
Identify areas or departments that need to be involved in the development and implementation of your e-commerce initiative; examples may include Finance, Information Systems and Technology, or Procurement and Contract Services.
Identify the working group to develop the initiative.

Following review and approval by the E-commerce Committee and the Financial Systems Management Committee, Finance will notify the requesting department of approval, determine the appropriate accounts and revenue object codes to be credited for sale proceeds, issue a unique merchant account(s) for the selling department, and set up an account with the University’s e-commerce payment processing service provider.
After the project has been approved, but prior to placing the application into the production environment, a "final walk through" of the e-commerce business processes and computer application will be conducted. The successful completion of this walk-through will result in approval for implementation.

Changes to the Departmental E-Commerce Business Plan

Significant changes to the departmental web site, products or services to be sold, intended customer base, anticipated transaction volume, application software, or changes in the departmental contacts responsible for the e-commerce business plan must be reviewed and approved by the E-commerce Committee prior to implementation. Proposed changes should be routed to Student Accounts Manager in Finance (NH).

Business Processing Assistance

The Student Accounts will assist departments engaged in credit card sales in the proper procedures for processing credit card transactions. Selling departments will be assessed the bank service fee on all credit card sales transactions plus a monthly “site fee”. Bank service fees range between 2.0% and 3.0% per transaction plus a monthly fee. Selling departments will be informed of the exact costs during setup of the site. These costs should be figured into the cost of departmental sales. In addition, departments are responsible for all federal and provincial sales tax if applicable. Questions on the applicability of sales taxes, and related reporting requirements should be addressed to Student Financials Manager in Finance (NH).

Technical Assistance

IST will provide guidance and assistance during the implementation of e-commerce sites as follows:

IST will provide advice and guidance regarding the technical security aspects of e-commerce projects.
IST may provide other support depending on the nature of the e-commerce project.

E-commerce Site Standards

Web sites which offer the electronic payment of goods and services must be developed and maintained using procedures identified by Information Systems and Technology and Finance.
All electronic sites must comply with the Payment Card Data Security Standard.
Electronic commerce sites must have mechanisms to ensure information transmitted electronically and stored electronically is protected from unauthorized access.
Departments that provide electronic commerce sites may be subject to an external security audit at the expense of the department.
Departments that provide electronic commerce sites may be subject to an internal audit of business and technical processes.
All University of Waterloo faculties, departments, and centers desiring to accept payment for financial transactions electronically via the Internet using e-commerce are required to process all sales transactions through the Finance approved e-commerce credit card processing service. Departments must not enter into separate banking or payment processing arrangements.
Departments that provide electronic commerce sites or use other services of the the Finance approved e-commerce credit card processing service are responsible for payment of all setup, transaction, and other fees.
All e-commerce sites must comply with terms and conditions outlined in the applicable merchant account and credit card processing service provider agreement(s).
Credit card information must be securely transmitted, stored and managed. Credit card information must travel in an encrypted format rather than in clear text format like e-mail and simple html forms.
Departments are responsible for retaining transaction records for audit purposes for a period of seven years.
Departments are responsible for safeguarding the confidentiality of sensitive data relating to the sale or purchase of goods and services. Information gathered about purchasers must be maintained in a secure manner and restricted to individuals who have a valid reason to know. Departments must comply with information privacy legislation and with University policies on information privacy.
Information gathered about customers must only be used for the purpose which the information was given as per UW's privacy guidelines.
E-commerce activities must adhere to all existing policies, procedures, and guidelines. The following is a list of relevant documents:

Enforcement

E-commerce Web servers not in compliance with this policy will be removed from service. Staff who manage non-compliant e-commerce Web servers, their supervisors, and unit administrators may be subject to penalties and disciplinary action, both within and outside the University. Violations will be handled through the University disciplinary procedures applicable to the relevant unit or employee.