1. Rld pci compliance project
Michelle Langehennig
Chief Information Officer
Regulation and Licensing Department

2. RLD Vision and Mission Boards and Commissions:
To ensure New Mexicans receive quality care and services from qualified professionals.
Construction Industries Division:
Provide code compliance oversight; issue licenses, permits and citations; perform inspections; administer exams; process complaints; and enforce laws, rules and regulations relating to general construction and manufactured housing standards to industry professionals.

3. Project Description
Bring New Mexico’s Regulation & Licensing Department (RLD) into compliance with Payment Card Industry Data Security Standards (PCI DSS) Self Assessment Questionnaire (SAQ)-A compliance, reducing the expenses imposed by PCI with RLD’s current credit card payment methods.

4. Project Scope
Redirect any of RLD’s self-hosted payment web pages to a custom payment page hosted by a PCI DSS 3.2 certified vendor.
Separate all credit data from RLD’s infrastructure.
One time cost to bring RLD into PCI compliance and minimize risks associated with hosting our own payment gateways.

5. Objectives
Achieve full PCI DSS 3.2 compliance for RLD and associated Permitting and Licensing application to increase the security of the card-holder data environment (CDE) and to reduce or eliminate penalties imposed by financial service provider.
Maintain PCI DSS 3.2 compliance through the life of the Permitting and Licensing programs and for as long as the PCI DSS compliance specification is relevant.
Reduce long-term cost of achieving and maintaining PCI compliance over the current costs.

6. Deliverables
PCI DSS 3.2 compliant payment portal that takes credit card payments from existing RLD applications, customizable and configurable by RLD IT staff.
Customized code within existing RLD applications that point to the new payment portal.
Policies and Procedures appropriate to the new SAQ-A environment.

7. Project Budget Item Cost Estimate CyberSource hosted payment portal
$267,400
hardware
$67,000
RLD IT Staff
$30,000
*Total
$364,400
*IV&V not currently budgeted, as waiver is being requested.

8. Governance

9. Stakeholders name Stake in Project Organization
License & Permit Applicants
Ability to Pay online
general public requiring permits or licenses
Front Desk Staff
process applications and answer questions in person and via telephone
RLD
IT Operations staff
Support the new system
CID/MHD Director
manage the division that processes applications for permits
B&C Director
manage the division that processes applications for licenses

10. Project Timeline Segment Network 3/31/2018 Payment Portal 6/30/2018
Acceptance 6/30/2018

11. Conclusion
RLD is requesting certification of $67,000 for the Initiation Phase of the PCI Compliance Project.