Understanding Web Debit

Overview

Web Debit refers to an ACH debit from a consumer account that is authorized through the internet or a wireless network. These transactions use the WEB SEC Code. Applicable Originators of Web Debit entries must also complete a Web Debit Security Audit (WDSA) to evaluate whether appropriate safeguards are in place to protect consumer financial information .

The WDSA evaluates whether an organization has documented policies and effective controls to protect non-public consumer financial information from unauthorized access, use, or compromise.

The audit focuses on four key areas:

• Physical Security.
• Personnel and Access Controls.
• Network Security.
• Account Validation.

The audit must be completed annually by applicable Originators of Web Debit entries.

Organizations that originate Web Debit entries and meet the applicable WDSA criteria must complete the audit. Web Debit involves consumer ACH debits authorized online or through a wireless network. Organizations notified by CSG Forte that a WDSA is required must complete the audit for the applicable compliance period.

If an organization believes the requirement does not apply to its processing activity, CSG Forte Customer Service should be contacted for assistance.

The audit should be completed by someone familiar with the organization's IT infrastructure, security controls, and data-handling practice.

Depending on the organization, this may include:

• An internal IT or Information Security representative.
• A trusted third-party IT provider.
• A security consultant.

Before completing the audit, the organization should review how it:

• Collects, stores, and accesses consumer banking information.
• Secures paper records containing banking information.
• Controls employee and third-party access.
• Protects electronically stored financial information.
• Validates consumer account information.

Each audit question should be answered according to the controls currently in place. A control that is planned but has not yet been implemented should not be represented as currently in place .

An organization does not need to answer "Yes" to every question simply to submit the audit. Each answer should accurately reflect the organization's current controls.

A "No" response identifies an area that requires remediation. The outstanding item must be addressed for the audit to achieve a fully compliant status.

If a requirement is not currently met:

• Identify the missing or insufficient control.
• Determine what needs to be implemented or changed.
• Establish a remediation plan and timeline.
• Implement the required control.
• Maintain documentation supporting the corrective action.

Examples may include implementing encryption, strengthening access controls, securely storing physical documents, or establishing the required account-validation process.

This is more appropriate than selecting "Yes" for a control that has not been implemented.

Organizations identified as requiring the annual WDSA can submit the audit using the Web Debit Security Audit form.

Before submission, all audit responses should accurately represent the organization's current security policies and controls. 

Eligible partners may complete a Partner Blanket Audit on behalf of associated merchants, subject to the applicable Web Debit requirements. Partners should contact CSG Forte Customer Service if they need assistance determining whether a blanket audit is appropriate for their organization.

Failure to submit the required WDSA may result in a non-compliant status. Non-Compliance Fee: Merchants failing to submit the audit are charged US $69.99. 

The following resources may provide additional guidance for reviewing or strengthening security practices:

• CIS Cybersecurity Tools, for cybersecurity tools and resources.
• PCI Security Standards Council, for general guidance on protecting payment and customer data.

These resources can support security practices but do not replace the WDSA when the audit is required. 

Organizations requiring assistance with audit applicability, audit responses, remediation requirements, or compliance status can contact the CSG Forte Customer Service team at customerservice@forte.net or 866-290-5400, Option 1

When contacting CSG Forte, the organization's Merchant ID and any Web Debit compliance communication received should be available.