Phase 2 and Phase 3

UNIVERSITY OF THE CUMBERLANDS

ITS 833 INFORMATION GOVERNANCE

SPRING 2019

I-G BI-TERM

PHASE II – Due Monday, February 18, 2019 no later than 11:30 p.m. Eastern Standard

Time.

Merchant’s Bank of America (your employer), a merchant bank or “acquiring bank” has selected

you to head up its IG Design, Development and Implementation team for the purpose of insuring

an enterprise wide information governance program related to its merchant customers

(depositors/account holders) who engage in credit card sales for whom you have placed point of

sale terminals (POS) in their organization, and for those merchant customers who engage in

internet sales for web hosting to capture your merchant customer’s online credit card sales. Recall

from the introductory material provided, there is a third party credit card processor (Superior Credit

Card Processor, Inc. “SCP”) who will collect the information from your merchant customers credit

card sales by using the POS/web hosting you have provided, and who will interact with the credit

card associations, and by extension with the “Issuing Bank” to process the credit card transaction.

Recall also, that the Issuing Bank will deduct its “interchange fee”, forward the balance of the

purchase money to SCP, who will deduct its own fee and well as your bank, Merchant’s Bank of

America’s fee. SCP will deposit your bank Merchant Bank of America’s fee (discount) into an

account earmarked to hold those credit card processing fees, and will then deposit the balance of

your merchant customer’s fee for the goods it sold on credit to its credit card purchasing customer

into the merchant customer’s checking account held with your bank.

For each of your merchant customers who are engaged in credit card sales, at the time SCP deposits

Merchant Bank of America’s credit card processing fee into MBA’s account, and deposits MBA’s

merchant payment amount into the merchant’s bank account with MBA, SCP will also provide

MBA (your employer) with the details of each transaction. At the end of the month, MBA will

provide its merchant customers (depositors) with detailed information for each transaction. After

all, the amount deposited into the merchant customer’s bank account held with MBA will certainly

show up as a “MERCHANT BANK DEPOSIT”. That is, it will appear on the merchant customer’s

bank statement as a deposit. For every single transaction wherein your merchant customers have

allowed their customer to purchase something on credit using their credit card, you will get the

detail of the transaction. SCP will send you the name of your merchant customer (depositor), their

account information, the name and credit card information and transaction information for each

customer of your merchant who made a credit card purchase. The information you are provided

will also include the dates of each transaction, the name and relevant information for the credit

card holder’s Issuing Bank, that bank’s interchange fee charged for the transaction, SCP’s fee

charged, the fee that SCP withheld from your merchant customer’s sales proceeds for you MBA’s

fee, and the net amount deposited into your merchant customer’s checking account.

Ultimately, your team as part of the IG design and development process will be required to set up

a records retention/disposal schedule for the information provided to MBA by SCP for the credit

card sales of your merchant customers. To that end, you will need to first perform a records

inventory.

1. You decide to use a two-step approach to conducting the records inventory, where you first send out survey questions to the appropriate departmental units, and then once you have

reviewed the responses you will follow up by conducting face-to-face interviews to expand

on answers and get more details to the initial questions you asked in the survey. You will

want to be able to speak intelligently to the knowledge personnel within the relevant

departments who will be responsible for creating/storing/processing information for your

merchant customers who have the POS terminals and/or internet sales capabilities, and who

will receive the information from SCP for each of your merchant customer’s credit card

sales, and who will store that information, process it and provide the appropriate

information to the merchant customer. Therefore, you need to do some preparation and

brainstorming before making contact with the department/units with whom you will be

interacting for the purpose of the records inventory.

a. To that end, identify (using diagram, table, hierarch chart, taxonomy charge, or any other form or combination of forms that are most descriptive of the records type or

data structure) what at this initial phase you expect will be contained in the records

inventory. Remember, this is a starting point for you. You have to give this some

thought before you know what to ask these knowledge people in the departments

you will survey/interview. Use descriptive names for each record type and tell the

type of information you expect will be included in each record type. If you decide

to use something as specific as a taxonomy, you may want to refer to Appendix A

of your text book. Or, in the alternative, you may conduct research and determine

what other structure would be most appropriate in order to convey this information.

Regardless of the form you choose to use, include in your brainstorming approach

a description of the record types (as explained above), departments responsible for

creating, maintaining, storing, reporting, etc. that information. This will probably

involve creating more than one record series. Don’t limit yourself. In addition, you

should include information about what type of event would trigger the creation

and/or destruction of the record type created.

b. Based upon the records/record series you have identified above, develop an initial records retention/destruction schedule for each. That is, for each record type

explain how long you expect to retain the record type or series, and then once

marked for destruction, explain the method of destruction you expect would be

used. When you plan to use event-based retention/destruction, identify the

triggering event. For this question, consider the legal requirements and compliance

considerations.

c. Once you have developed or designed your record series, please explain or describe this in narrative form. I WILL NOT ACCEPT just a table with no explanation.

Remember, while tables or diagrams are useful, they will not substitute as your

narrative explanation. Tell what each record series describes, and a justification for

its content.

2. Develop a Record Inventory Survey Form that you are going to use in surveying the departmental unit(s) that you have identified above as relevant. The purpose of your survey

is to be able to identify the kinds of records each department “owns”, which other

department(s) need access to the record series, what applications(s) create the record series,

where the record is physically and logically stored, the date created, last changed, whether

it is a vital record, and whether there are other forms of the record (is it redundant?). You

want to be able to use this information to make decisions related to retention and disposal

of records, as well as identifying how you can achieve your high level goals and resolve

issues or problems related to retention and disposal (keeping records beyond the period of

time you need to keep them, not keeping information that is necessary for legal defense of

the organization, retaining information that PCI DSS forbids, release of protected

information, etc.).

Of course, you will have a set of survey questions that is not “narrative”. In addition to the

Records Inventory Survey Form, explain in narrative form your general logic in developing

the survey the way you did. That is, who was the target, why you chose to go in a certain

direction with the survey questions (what you hoped to achieve with them), and why you

left out certain things, possibly to include in your interviews to be conducted later.

3. Develop an initial set of interview questions that you plan to use as a follow up to the initial survey that you drafted in question 2 above. That is, what kinds of information that you

included on your initial records inventory survey will require more specifics once you can

speak with the knowledge individuals who answered the initial survey. Your response to

this question will include list of survey questions on a form you would want to use to take

with you when you conduct your follow up interview. In addition, give me a narrative

explanation explaining how you went about deciding what to include on the interview,

what you hope to achieve by it, etc.

Remember, for credit card information you must consider the PCI DSS compliance requirements.

There is the PCI DSS Security Standards Council® that provides oversight and considerable

information that may be of help to you. See https://www.pcisecuritystandards.org. I will include

some of the council’s literature in the content section, within the semester project folder. This is

optional information. It may be more than you require. For some students it may be overwhelming.

If you begin to browse through it and do not find it useful, then don’t bother. For others, it may

provide you with insight or ideas for responding to Phase II. All of it was obtained from the

Counsil’s website identified above and has been reproduced in the Semester Project section simply

as a convenience to your and as an educational tool.

With regard to Phase II, you may organize your response in any manner you choose. However,

you may want to consider the following “TIP” and to what I expect will be most useful in assisting

me in grading Phase II, essentially what I am “looking for”.

Tip 1: I expect is that you will give me a general introduction to MBA, your role therein,

some problems that the organization faces, its objectives in implementing IG with regard to its

merchant customers who accept credit cards and with whom MBA has provided that capability.

Then go on to explain to me how visualizing the record series that you are about to describe will

assist you, the purpose of the records inventory and the two-step process you are asked to use to

carry it out, the purpose for designing a record retention/destruction schedule and its advantages

and disadvantages. That will be contained in your general introduction.

Tip 2: Following your general introduction, you will divide the rest of your paper into the

subsections that address (1) the narrative for the record series you design, followed by the visual

depiction of the record series you design (2) a narrative for a records retention/destruction schedule

or plan for the record series identified in the prior section, possibly followed by a table or chart

depicting your records retention/destruction schedule, (3) the narrative for the records inventory

including the narrative for the survey, followed by the survey form(s), and a narrative for the record

inventory questionnaire followed by the questionnaire.

Tip 3: Make sure to use a cover page that contains the name/number/section of the course,

the semester and term (IG-Bi-Term, Spring 2019), your full name (not nickname), your student id,

and PHASE II. Make sure that you DO NOT violate copyright laws by including the University

Of the Cumberlands official logo as part of your cover page. Include a table of contents after the

cover page. Include a list of appendix that reference your diagrams, or tables used in your paper.

Double space that paper and use “normal” margins. (Some students used HUGE margins on Phase

I to try to make it appear longer. Don’t do that.) Include a page number at the bottom of each page.

Tip 4: Submit Phase II using the link provided. DO NOT EMAIL Phase II to me. Make

sure it is in WORD format. Make sure to click the link to submit your paper to global reference

database so that it can be used for comparison for plagiarism checking.

Tip 5: Know that Phase II is due no later than 11:30 p.m. Eastern Standard Time on the

due date. (Regardless of how many times I include this, there are students who tell me they didn’t

know when the deadline was.) Due date is Monday, February 18, 2019.