Policy-PCI Compliance

NAVIGATE

Take me to ...

Intro Hamra Charter Benefits – 401K Benefits – Health Insurance Benefits – Meal Discount Policy Benefits – Jury Duty Benefits – Vacation (Chill Time) Benefits – Sick Benefits – Holidays Benefits – Bereavement Leave All Federal and State Laws Laws – Unpaid Breaks Laws – Pay Schedule Policies – General Work Rules
Policies – No Harassment Policy & Reporting Policies – Dress Code Policies – Change of Availability Policies – Requests for Time-Off Policies – Smoking Policy Policies – Leaving Us Policies – Attendance Policies – Confidentiality Policies – Personal Property Policies – Social Media Policies – Personal Relationships in the Workplace Policies – Food Employee Illness Reporting Policies – Safety Equipment The End
Equal Employment Opportunity ADA Conformity to Applicable Federal and State Laws Right to Know Law FMLA Victims’ Economic Security and Safety Act (Illinois only) Uniformed Services Employment and Reemployment Rights Act FLSA Age Verification and I–9 Information Minor Job Restrictions Massachusetts Maternity Leave Small Necessities Leave Act (Massachusetts only) W.I.S.P Adherence (Massachusetts Only) Massachusetts Pregnant Workers Fairness Act
Massachusetts Paid Family and Medical Leave Employee Notice- Illinois Employee Notice- Massachusetts Policies- Leave of Absence Extensions Hamra Biometric Data Policy Illinois Food Handler Opt in to Hamra Text Policy-PCI Compliance Food Handler-Illinois Only Policy-Cash Control Hourly Job Description

Policy-PCI Compliance

Most of our customers pay for their meals with either a debit card, or a credit card. Because there are bad people out there (not at Hamra, just out there) the credit card companies got together and created a policy that we must follow in order to stay in the good graces of the credit card companies. We do this to be in compliance, but more so we do this so our customers know we are keeping their information safe. Read below for the legal policy:

What is PCI Compliance? The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that ALL companies that process, store or transmit credit card information maintain a secure environment. Essentially any merchant that has a Merchant ID (MID).
The Payment Card Industry Security Standards Council (PCI SSC) was launched on September 7, 2006 to manage the ongoing evolution of the Payment Card Industry(PCI) security standards with focus on improving payment  account security throughout the transaction process. The PCI DSS is administered and managed by the PCI SSC (www.pcisecuritystandards.org), an independent body that was created by the major payment card brands (Visa, MasterCard, American Express, Discover and JCB.).
It is important to note, the payment brands and acquirers are responsible for enforcing compliance, not the PCI council.

Security Policies

Applies to all who have access to BOH and register operators

Physical Security
  • Video cameras will be installed to monitor equipment access and stored for a minimum of 30 days
  • Nametags or company logoed apparel must be word by all employees, in accordance with the franchise uniform policy
  • Visitors must either have an appointment or have required credentials as supplied by a government agency or approved third party vendor (ex. Health inspector, Steritech, etc.)
  • Visitors must be escorted at all times they are not in public areas
  • Paper shredders must be available at all of the units. Personal information and other secure data should be shredded when discarded.
The following should be used as guidelines for accessing sensitive data:
DO:
  • Maintain personal safety and privacy while accessing the Internet, and use caution not to reveal personal information that could lead to identity theft
  • Use appropriate and polite language while online and through electronic communication
DO NOT:
  • Send, receive, view or access any material that is obscene, defamatory or intended to annoy, harass or intimidate another person
  • Send email that is unsolicited, unrelated to business activities, for personal gain or contains confidential information without suitable encryption
  • Send, reveal or publicize confidential or proprietary information, including sensitive information, outside of the company without prior permission
  • Download any software or electronic files without prior permission and approved virus protection
  • Reveal or share passwords or allow someone else to use your account, including family members when working from home
  • Attempt to circumvent the authentication or security of any system, including impersonating another user or system, or testing the security of a system
  • Corrupt or destroy another user’s data or violate the privacy of anotheruser online
  • Disturb or disrupt any other user or system, including propagating viruses 0r malicious programs, using sustained high volumes of resources, or performing any sort of denial of service
Education
  • All employees will be trained on information security issues
  • Refresher training will take place on an annual basis
End User
  • All users must be aware of their personal contribution to the security of the information housed by the equipment at Hamra Enterprises and its affiliates
  • Embrace the “security is everyone’s responsibility” philosophy
Human Rsources/Training
  • HR and Training is to work with IT to ensure the initial and annual training of PCI Compliance
  • Develop sanctions and discipline as it is related to the security of information
  • Notify IT as employees with access are terminate.

Physical Access

  • Access to the wireless network equipment will be limited to authorized personnel
****Any violations to the above bullet points will result in disciplinary action, up to and including termination****
I have read the Information Security Policy and understand the policies contained in it. I have access to a copy of
the policy and have had the opportunity to ask questions and discuss the policy with my Supervisor or another representative of the Company. I agree to conform to the policies and will take all reasonable precautions to assure that Hamra Enterprises internal and customer information will not be disclosed to unauthorized persons. I agree to promptly report all violations or suspected violations of information security policies to the IT Project Coordinator.
At the end of my employment or contract with Hamra Enterprises, I agree to return to Hamra Enterprises any records of information to which I have had access as a result of my position with Hamra Enterprises. I understand that I am not authorized to use this information for my own purposes, nor am I at liberty to provide this information to third parties without the express written consent of the CIO. I understand that non compliance will be cause for disciplinary action up to and including dismissal from Hamra Enterprises, and perhaps criminal and/or civil penalties.