All hardware, including but not limited to servers, firewalls, etc., approved for credit card payment activity must be housed within the ITS Department and administered in accordance with the requirements of all University policies and the PCI-DSS. POS hardware is the exception to this rule, which will be provided by CMS.