Case study: University of Exeter and Securious  

Securious has been working with the University of Exeter on its PCI compliance since 2015, with a focus on bringing together its different departments to improve the security of cardholder data.   

About the University of Exeter 

The University of Exeter is a public research university based in Exeter. It is a member of the Russell Group of UK universities, welcoming 30,000 students from 150 countries to its four friendly campuses each year 

Home to world-leading academics including the UK’s five most influential climate scientists, Exeter strives to use the power of education and research to create a sustainable, healthy, and socially just future.. 

About Securious 

Securious is the South West’s leading Payment Card Industry Qualified Security Assessor and cyber security company. We help clients with Governance, Risk and Compliance (PCI DSS, ISO 27001, PCI 3DS, Cyber Essentials and Cyber Essentials Plus); we offer a Managed Detection and Response service (helping clients stay secure with live 24/7 monitoring and visibility of their environments, threat detection and automated alerts, which are overseen by our analysts), and penetration testing services. 

The objective 

To ensure the University was Payment Card Industry Data Security Standard (PCI DSS) compliant to reduce transaction charges and ensure they were doing all they could to protect their students’ (and other customers) credit card details. 

The challenge  

With a diverse retail outlet estate on its campus and multiple  payment methods, achieving PCI DSS compliance was no small task. 

The biggest challenge was the need to coordinate multiple stakeholders and departments, each with their own priorities and pressures, to ensure a concerted approach was taken.  

This included educating key parties on the importance and requirements of PCI compliance and putting appropriate measures in place to meet the PCI Standard.  

The solution  

In practice, Securious’s main role was to break the overall requirement into a series of smaller steps and then communicate with the various relevant departments to ensure they understood why these needed to be done and to help ensure their buy in to the bigger picture objective of ensuring PCI DSS compliance. 

In other words, we helped turn what seemed like a really overwhelming and complicated task into one that has become entirely manageable. 

We started with a gap analysis and helped define the scope of compliance activity to reduce risk. In particular, we were able to help the finance, security, compliance and IT teams better understand each other’s requirements, which in turn resulted in people working together to deliver recommended changes to the environment. 

The results  

The University of Exeter is in excellent shape with respect to its PCI compliance.  

For example, they now operate paperless receipts, have no card data storage, use  3rd party payment providers who integrate common payment methods, and their support staff generally have much better awareness of the requirements of PCI compliance internally. 

This is great news for the University, its students and anyone else who uses their payment card for any of its services or in any of its retail outlets. 

As result of the hard work already put into achieving and maintaining compliance, this has also helped put the University of Exeter in a good place for the upcoming PCI DSS v4.0. 

Pete Woodward, Securious Cofounder and CEO, comments:   

“Universities typically have numerous retail outlets on their sites that handle huge numbers of payment card transactions. Ensuring they are PCI DSS compliant is crucially important, not just to protect the payment card details of their students (and other customers), but also to minimise transaction charges and the risk of reputational damage in the event of a breach. 

“However, achieving this can seem overwhelming and universities often lack a central point of focus to take ownership of the process. This is where we can help. We understand the different requirements and are able to simplify the process as much as possible while bringing the various stakeholders and departments together to make any changes or updates that are needed. 

“It might start off seeming hugely complicated, but in reality, with our support and guidance, it is a relatively straightforward process for a university to ensure they are and remain PCI DSS compliant. 

“We’ve really enjoyed working with the University of Exeter on their PCI DSS compliance and look forward to continuing our work together.”  

Sarah Ascott at the University of Exeter comments:  

“It’s been a pleasure working with Securious on our PCI compliance over the last few years. A longstanding relationship with a PCI QSAC that really understands our organisation makes the process of maintaining compliance so much easier.  

“The team at Securious have been instrumental in helping us achieve compliance, facilitating the collaboration of different departments and helping identify where each responsibility sits.”