How to Prepare for a PCI Compliance Audit in Higher Education

Step 5: Train Staff and Update Policies

People play a crucial role in PCI compliance. All the technology in the world won’t help if an employee is tricked by a phishing email or mishandles sensitive data. That’s why preparing for an audit involves investing in staff training and policy awareness.

• Security awareness training: Ensure that everyone who handles payment data or systems on campus is trained on basic security practices. This should include training front-line staff (cashiers, clerks) not to write down card numbers or email them, as well as training IT administrators on secure system maintenance. PCI DSS actually requires that staff with access to cardholder data receive security awareness training annually. Teach them about social engineering, phishing, and proper data handling. Universities sometimes underestimate training, but it’s a powerful defense​. For example, staff should know not to let someone tailgate into a secure server room, or to report suspicious phone calls asking for card info.

Source: arrowpayments.com

• PCI-specific training: In addition to general security, provide PCI-specific guidance. Make sure employees understand why PCI exists and the importance of complying. Go over key do’s and don’ts: e.g., “Do use the approved payment terminal for phone orders; don’t ever jot down card numbers on paper.” University environments often have student employees or new staff in cash handling roles each year – include them in training cycles so that nobody is operating out of ignorance. A well-trained staff is less likely to accidentally cause a compliance failure. Remember, many data breaches trace back to human error. In fact, the cost of breaches due to human error averaged $3.33M according to an IBM study​, so investing in training can pay off by preventing incidents.
  
  
• Policy updates and attestation: Before the audit, review all your PCI policies and procedures to ensure they are up to date with current practices and PCI DSS version 4.0 requirements. Update them if needed and get the necessary approvals. Policies might cover areas like acceptable use, data retention, incident response, vendor management, etc. Once updated, redistribute these policies to relevant personnel. It’s wise to have staff attest (sign off) that they have read and understood the policies – this can be done via an online training portal or even a simple sign-in sheet at a training session. During the audit, you might be asked how you ensure personnel are aware of their responsibilities; having signed policy acknowledgments is a good answer.
• Simulate incident response drills: As part of training, consider running a tabletop exercise or drill for a payment security incident. PCI Req. 12.10 requires an incident response plan. Practicing it (e.g., simulate a lost credit card receipt or a suspected malware breach) will train your team and also impress upon them the seriousness of protecting card data. It’s better to find weaknesses in your response plan now than during a real incident. Auditors sometimes ask staff “What would you do if...?” to gauge their awareness. Well-prepared staff will shine in such scenarios.
• Cultivate a PCI culture: Ultimately, the goal is to cultivate a culture of compliance and security. Decision-makers at the university (CIO, CFO, department heads) should set the tone that PCI compliance is a priority. When staff see leadership engaged – for instance, the CFO personally attending a PCI training or the IT Director sending out security tips – they realize that this audit is taken seriously. A positive, educational approach works better than a punitive one. Make it about protecting the campus community (students, alumni, staff) from fraud. That mission resonates more than “because the auditor says so.”

By the time the audit begins, your staff should not be caught off guard by questions or tests of procedure. They’ll know the policies and follow them. Your training efforts not only help pass the audit but also reduce the likelihood of a breach in the first place – which is the true intent of PCI compliance​.

Step 6: Work with the QSA (External Assessors) and Final Audit Prep

If your university is undergoing an external audit (Level 1 or 2 merchant, or a required QSA assessment), the final phase of preparation is to smoothly coordinate with the Qualified Security Assessor and tie up any loose ends before the audit date.

• Select your QSA firm early: If you haven’t already engaged a QSA company, do so well in advance (several months before your compliance deadline). Universities often issue an RFP or use a recommended QSA. Look for a firm experienced in higher education or similarly complex environments. Once selected, schedule the audit for a time that gives you enough runway to remediate findings before the deadline. Many institutions schedule the audit several weeks before the final due date for the ROC/AOC, so there’s time to address any issues the QSA finds.
• Pre-audit communication: Communicate with the QSA about what to expect. Good QSA firms will send an audit checklist or evidence request list beforehand, usually a few months or weeks out​. This list outlines all the evidence and artifacts they’ll want to review – policies, network diagrams, sample configurations, user lists, etc. Go through this list meticulously and gather everything. If there are items you’re unsure about, ask the QSA ahead of time. Early clarification can save time during the audit. Also discuss the audit scope and on-site visit plan with the QSA so everyone agrees on which systems and locations will be examined.

Source: securitymetrics.com

• Finalize remediation of gaps: Use the time before the QSA arrives to resolve any remaining gaps identified in your internal review. If there were issues you couldn’t fix earlier, now is the time to get creative – either implement a compensating control or document a solid justification if applicable. For example, if an old system can’t technically enforce strong passwords, you might implement additional monitoring and formally document a compensating control (though with PCI DSS 4.0, compensating controls require careful justification). Aim to enter the audit with as few “known issues” as possible.
• Audit logistics and on-site coordination: Plan the on-site (or virtual) audit days in detail. Who will the QSA need to interview? Schedule those meetings with department reps or IT admins. Make sure key staff are available and not on vacation during the audit window​. Arrange for workspace and access for the QSA – if on-site, a quiet conference room with network access is ideal; if remote, ensure they have VPN accounts or screen-sharing set up. Notify campus security if the QSA needs after-hours access to data centers, etc. Essentially, treat the QSA like an important visitor – because they are. The smoother their experience, the more efficiently the audit will go. Also, obtain an agenda from the assessor and share it with all involved parties so everyone knows the schedule​
  
  
• During the audit: be responsive and transparent: When the QSA is conducting the assessment (reviewing configs, interviewing staff, observing processes), respond promptly to requests. Provide additional evidence quickly when asked. If the QSA identifies potential gaps, work with them – in many cases, you can address minor findings on the fly. For instance, if they notice a few missing security patches, you might apply them during the audit week and that issue can be marked resolved. Demonstrating a cooperative attitude goes a long way. Remember, the QSA’s goal is to verify compliance, not to “catch you out.” If you’ve prepared well, there should be no sense of adversarial tension.
• Take note of findings and feedback: As the audit concludes, the QSA will typically hold a closing meeting to summarize any findings. Pay attention to any non-compliant items (NCs) they list. You usually will get a window (e.g., 30 days) to remediate those before the final report​. Make sure you understand each finding and what evidence or change is needed to address it. Don’t hesitate to ask questions or even respectfully discuss if you believe something was compliant – QSAs can occasionally make mistakes or misinterpretations, and providing clarifications can resolve an issue. However, if it’s indeed a gap, accept it and plan to fix it immediately.
  
  
• Report and attestation: After remediation of any post-audit findings, the QSA will issue the formal Report on Compliance (for Level 1) or review your SAQ and issue an Attestation of Compliance. Ensure that you receive these documents and submit them to your acquiring bank or card processor by the deadline. Also, take the QSA’s final report as a learning tool – it will often highlight areas for improvement, even if you passed. Share relevant lessons with your team and incorporate them into next year’s compliance plan.

Working with external assessors can actually be a positive, educational experience if you approach it collaboratively. QSAs have seen many environments and can offer insight. In fact, they are impartial third parties hired to ensure PCI standards are met​, whereas a partner like Arrow Payments (or your internal team) can assist with the remediation and system improvements around the audit​.

Source: arrowpayments.com

Both have their role: the QSA to validate compliance, and advisors or internal experts to implement solutions that reduce complexity and risk. By effectively bridging these, universities can not only pass their audits but also streamline compliance in the future.

Timeline: A recommended PCI audit preparation timeline for universities, counting down key tasks from 12+ months before the audit to 2 weeks before. Early engagement of assessors, policy updates, system fixes, and staff readiness checks should be scheduled well in advance of the on-site assessment.

As shown in the timeline above, starting early is crucial. Larger institutions might begin planning a full year out from their audit, whereas smaller ones should still give themselves a good few months head start. The timeline illustrates milestones such as engaging a QSA, completing internal reviews, finalizing documentation, and confirming logistics in the weeks leading up to the audit. Following a structured schedule ensures nothing important is overlooked. By two weeks before your audit, you want to be in audit-ready shape, conducting final polish – not scrambling to fix major issues.