CourseVector
PO Box 102
Enola, PA 17025

We are still working out the PSAB office. But, sending checks to PSAB gets confusing. With Mike looking at a partial retirement, we thought it was a good time to begin transitioning to a new address.

We’re so grateful to all who could join CourseVector and Triscari at our inaugural

Professional Day Exchange.

This year’s Professional Day Exchange brought together professionals from across our community for a day of learning, connection, and inspiration — all centered around the theme of professional and personal growth.

We kicked off the morning with fresh coffee from Nour, fueling great conversations and networking with our wonderful collaborators.

The event gave us a unique opportunity to not only meet the wonderful Course Vector staff who helped reformat our websites, but also connect with some of your other clients and learn about their services. Lunch was also a delicious and added bonus!  Everyone was incredibly welcoming & friendly, as always.

~ Carleigh Williams
Project Coordinator AP Williams

I really enjoyed the setup of the networking event.  I had plenty of time to visit with different people and really get to know them and their businesses.  I loved that it was quiet and we could actually talk to each other, instead of just pretending that we could understand each other over the noise, like I do during most networking events.  I would love to have a table next year!

~ Marsha Cleff
6Star Resume

Omega eCycles‘ Reesy Neff presented thoughtful discussions on how to better serve our communities while responsibly disposing of unwanted electronics and clutter — a perfect blend of sustainability and service.

Great small personal event.  Made a couple good contacts.  TU for the invite.

~ Steve Troutman
Senior Solutions Consultant Greenstar Cloud

Catalyst by Design’s Samantha Stewartz shared practical strategies to combat the challenges of a sedentary job, reminding us that even small movement habits can make a big impact on long-term health and productivity.

Thank you Coursevector for inviting me to the networking event. I made several contacts and gained a lot of useful information. The event was a great success as far as I am concerned.

~ Nora Sites
Nora’s Country Attic

Chef Lou Sackett, founder and teacher at Prep Hold Cook, treated everyone to a delicious, make-ahead lunch — the perfect example of how a little preparation can make healthy eating easy, even on the busiest days. We even go to take home three exclusive recipes that perfectly exemplified her mission of prep (make a delicious dinner), hold (have leftovers – no problem), and cook (have lunch for the next two days)!

It was great to meet the staff of CourseVector in person finally, and also to learn about Triscari.  I enjoyed talking to Mike about earning revenue through sponsorships, and look forward to hearing about the social media marketing plans you and Abby will develop.  And my compliments to Armani; for such a young man, he’s very personable and well-spoken – his enthusiasm is refreshing.

~ Chef Lou

A huge thank-you to all our speakers, vendors, and participants who made this event possible. We look forward to seeing everyone again at The Exchange: Spring Edition!

CourseVector is proud to bring together such a wonderful and talented group of professionals for a day of networking and career building opportunities.

However, many business overlook some key aspects of PCI compliance that increase their vulnerability. Here are six things to keep in mind as you move toward or evaluate your own PCI DSS compliance. Even though you don’t process cards directly, you could still fail the approved scanning vendor (ASV) scan because your public-facing systems are vulnerable.

PCI DSS is about protecting the whole environment around card activities, not just the direct flow of cardholder data.

6 Quick Tips to Keep Cardholder Data Safer

1. Secure the Entire Environment
   • Secure everything in the Cardholder Data Environment (CDE)
   • Use HTTPS everywhere
   • Update and maintain SSL/TLS certificates
2. Patch and Update Regularly
   • Patch servers, applications, and plugins, apply security patches within 30 days of release wherever possible
   • Monitor and update CMS platforms (e.g., WordPress, Joomla, etc.) regularly.
   • Remove outdated software
   • Eliminate old plugins, themes, or test apps not actively used
3. Secure Cardholder Data and Authentication
   • Enforce two-factor authentication (2FA) for all remote access to CDE systems
   • Test two-factor authentication periodically to ensure it’s functioning properly
   • Use tokenization for sensitive card data
4. Harden Public-Facing Systems (Websites, Servers)
   • Remove unused public-facing test pages or admin panels
   • Disable directory browsing
5. Manage Third-Party Access Carefully
   • Limit third-party vendor access
   • Audit third-party connections
6. Know and Control Your Data Storage
   • Identify where cardholder data is stored
   • Ensure no unnecessary storage of Sensitive Authentication Data (SAD) like CVV codes or full magnetic stripe data

PCI DSS 4.0 Changes

While redirecting customers to a payment processor may exempt you from certain PCI security measures, under new guidance you may now be required to comply with quarterly security scans. It’s important to note that even if you’re not handling payments on your website, your website might be a target. Attackers may inject malicious scripts (e.g., Magecart attacks) into your site or intercept the redirection process—allowing them to steal payment data before it reaches the processor. PCI DSS version 4.0 introduced these new security measures to protect consumers from malicious redirects.

What is a Redirect?

Here’s how PCI Security Standards Council explains it (and how PCI DSS treats it):

• A true redirect (under PCI DSS) means your website actively sends the customer’s browser to another page automatically — without the customer needing to click anything.
  • Example: An HTTP 30x server-side redirect, or JavaScript that forces the browser to jump to another URL.
  • User doesn’t have a choice.
• A plain hyperlink (a normal <a href="https://paymentprocessor.com">Pay Here</a>) just offers a link is not generally considered a redirect. The customer has to click it.
  • That means your site isn’t controlling the redirection — the user is.
  • This is treated much more like simply “navigating away” — not an automatic redirect.

Do I need a Scan?

Even if you only link to a payment processor, an approved scanning vendor (ASV) may still scan your public website because:

• It’s on the internet (public-facing = “reachable by IP or domain from the outside world”).
• Hackers could attack your site and use it as a stepping stone (e.g., to inject skimmers, redirect customers, or hijack traffic).
• PCI DSS cares about the entire security posture of systems that interact with payment activities — even indirectly.

The onus ultimately falls on the customer. Therefore, it may behoove you to be overly cautious and get the scans rather than assume that everything is kosher. For more information, you can check out the Scan Scope in the ASV guide, section 5.5.

Hiring a Security Firm for PCI ASV Vulnerability Scans

To ensure that your website / server are safe and secure for customer transaction, you must hire a PCI-certified security firm to scan for malicious code. An approved scanning vendor, or ASV, is a company with PCI-approved security tools used to perform external scans required by PCI DSS Requirement 11.3.2. Their scanning solution must be tested and approved by the PCI Security Standards Council before they are officially recognized. These scans must identify vulnerabilities from outside the organization’s network (like over the internet) to ensure that systems exposed to the public (e.g., websites, firewalls) are secure.

In simpler terms:

• Scans occur every 90 days, plus after major changes (like server moves or firewall rule updates).
• You must have an outside PCI-approved company scan your internet-facing systems.
• ASV scans exist to check for security holes that hackers could exploit.

Important:

• The scans must pass (no high vulnerabilities allowed).
• The scans must be performed by an official ASV (not just any IT company).
• You cannot perform your own scans.
• If you fail, you have to fix the issues and rescan until you pass.

They are scanning for vulnerabilities that could:

• Allow hackers to inject malicious scripts (like Magecart attacks)
• Redirect customers to fake payment pages
• Take over your domain to impersonate you
• Harvest information that would weaken the security of your payment process indirectly

What does the ASV Scan Entail?

When you hire an ASV to scan your website / server for PCI vulnerabilities, here’s what to expect.

1. Scoping

• Objective: Define the scope of the external vulnerability scan.

You will give the ASV a list of public-facing IP addresses, domains, and websites that belong to you.
(Even if you only link to a payment processor, your website itself is still Internet-facing and must be scanned.) The scope is then verified by the ASV.

2. Scanning

• Objective: Conduct the external vulnerability scan.

The scan usually starts a few days after scope approval. It identifies vulnerabilities and misconfigurations in the Internet-facing systems. The ASV should Ensure that the scan does not disrupt normal operations or compromise system integrity.​ Here are a few of the items they look for:

• Open ports you don’t need (like FTP, telnet, older web ports).
• Outdated software (WordPress plugins, server versions, etc.).
• SSL/TLS vulnerabilities (like weak ciphers, expired certificates).
• Known vulnerabilities (e.g., vulnerabilities in Apache, nginx, WordPress core, etc.).

3. Reporting

• Objective: Rectify any vulnerabilities found during the scan.

Once the scan is complete, you’ll get a report with vulnerabilities listed by severity:

• High (must be fixed to pass)
• Medium
• Low
• Informational (do not impact compliance)

To pass, you must have no High vulnerabilities and usually no severe Mediums either. Once you pass, you’ll receive a passing Scan Report and an Attestation of Scan Compliance (AOSC) (official PCI paperwork). You submit this paperwork to your acquiring bank, processor, or PCI program manager — not directly to PCI SSC.

If you fail, they will give you a chance to fix the issues and request a free rescan (typically 1–2 rescans included). “With a few exceptions, any vulnerability with a CVSS base score of 4.0 or higher will result in a non-compliant scan report, and all such vulnerabilities must be remediated by the scan customer.”

What if I Disagree with My ASV?

The ASV you hire is the only one who can issue your “Pass” or “Fail” result for PCI DSS Requirement 11.3.2. If they say you failed, you failed, even if you believe they made a mistake — unless you successfully dispute it through their formal process. You can’t just get a second opinion from a different ASV for the same scan window. You must fix the findings they reported or formally appeal their decision.

PCI DSS relies on the idea of independent validation — meaning you can’t “shop around” for a better result once an official ASV has performed a scan. The ASV must follow very strict PCI SSC scanning procedures — they are audited themselves. Allowing merchants to argue or hop between ASVs easily would undermine the integrity of the system. Common causes of failure even for redirecting merchants might include weak TLS settings (SSL issues) or outdated plugins on CMSs like WordPress. This is where it helps if you have a security-minded hosting partner for your website. While this doesn’t guarantee the server is PCI compliant, it should provide assurance that your site is up-to-date on security features and you have someone who knows what they are talking about in your corner should you need to dispute a failure on an ASV report.

How to Dispute a Finding

Request a False Positive Review:

• Most ASVs have a documented “false positive dispute” process.
• You provide evidence (like vendor documentation, CVE clarifications, or patch info) proving their finding is invalid.
• They review and, if they agree, they may reclassify the vulnerability (so you can pass).

Fix it anyway:

• Even if you disagree, sometimes it’s faster to apply a patch, reconfigure, or mitigate and then ask for a rescan.

Change ASVs — later:

• After your scan period is complete (and no pending disputes), you can change vendors for the next quarter.
• You cannot switch mid-scan just because you disagree with the findings.

In Conclusion

Many of our clients don’t use redirects and don’t store/process card data. Therefore, their risk surface is small, meaning scans are usually fast. Vulnerabilities, if any, will likely be web server configurations (not payment-related) or forgotten test pages. It is important to remember at the end of the day it is up to the judgment of the ASV as to whether the client passes or fails the quarterly scan.

CourseVector does offer PCI compliant servers. If you’ve hired an ASV or otherwise need a PCI compliant server, please contact us.

Remember that if you want extra help with PCI compliance (like someone guiding you through the SAQ or explaining vulnerabilities),

• Hire a separate PCI consultant, or
• Use an ASV vendor that offers optional (separate) advisory services through a different division.

In 2024, a new ADA law came into effect, reinforcing the importance of making online content accessible to everyone, including people with disabilities. This includes audio and video content, which should adhere to WCAG 2.1 AA guidelines for accessibility. For municipalities recording meetings or small businesses posting informational videos or other audio / visual content, ensuring compliance can seem daunting, but there are straightforward steps and tools that can help.

Why ADA Compliance Matters

ADA compliance is not just about avoiding legal issues; it’s about inclusivity. Making your audio and video content accessible ensures that all individuals, regardless of hearing, vision, or cognitive disabilities, can engage with your content. This accessibility benefits your community by providing equal access to essential information, such as local government proceedings or informative content about products and services.

Levels of ADA Compliance for Audio and Video Content

The Web Content Accessibility Guidelines (WCAG) outline three levels of accessibility: A, AA, and AAA. The law requires AA compliance, which balances accessibility and practicality. Here’s what AA compliance generally requires for audio and video content (time-based media):

1. Captions for Videos: Provide accurate, synchronized captions for all spoken dialogue and important sounds. Captions help those who are deaf or hard of hearing.
2. Audio Descriptions: If your video includes important visual information that isn’t conveyed through the audio, add audio descriptions to describe these elements. This feature supports users who are blind or have low vision.
3. Transcripts for Audio Content: For audio-only content, provide a text transcript that users can read. Transcripts are useful for those with hearing impairments and those who prefer reading over listening.

The Case for Using YouTube

Many municipalities and businesses choose YouTube as their primary platform for hosting video content. YouTube offers several built-in accessibility features that make it easier to meet ADA requirements:

• Auto-Generated Captions: YouTube can automatically generate captions for videos. While this feature is convenient, it’s not always accurate, so it’s crucial to review and edit the captions to ensure they are correct.
• Adjustable Playback Speed: Users can slow down or speed up videos, which is beneficial for viewers who need more time to comprehend the content.
• Screen Reader Compatibility: YouTube’s interface is designed to be compatible with screen readers, making it easier for visually impaired users to navigate.

However, relying solely on YouTube’s accessibility features may not be legally sufficient. Despite its inherent benefits, automatic captions can misinterpret speech, leading to inaccuracies that may not meet ADA standards. Given the evolving nature of ADA law, there’s no definitive answer on what will hold up in court, so it’s wise to be proactive in ensuring the accuracy and accessibility of your content.

A municipality should check with its solicitor to ensure their compliance is appropriate.

Services to Enhance Accessibility

For organizations aiming to meet AA compliance without relying entirely on YouTube’s features, external transcription and captioning services are available. These services can provide more accurate and customizable options for making your audio and video content accessible. Wirecutter did a review of these services in 2024 and found two they liked the best.

1. GoTranscript
GoTranscript offers professional transcription services, including captions and subtitles. Their team ensures accuracy, which is crucial for compliance, and they can provide a quick turnaround time, which is useful for municipalities that need to post meeting recordings promptly.

2. Vook.ai
Vook.ai uses AI to transcribe and create captions. While the service is automated, it provides a good starting point, and you can edit the captions to ensure they meet accessibility standards. This service is often more cost-effective than professional transcription services, making it an excellent option for small businesses or municipalities with tighter budgets.

Other transcription services that you may find useful:

• Read.ai is a good choice for organizations needing meeting transcriptions, especially with integration into video conferencing platforms, making it convenient for live use cases. It is a cost-effective option for short or occasional use with its free tier, while its Pro plan is priced competitively for longer sessions and frequent users.
• Rev.ai is one of the more flexible options, with human transcription at a higher cost but exceptional accuracy. They also offer captions and subtitles, enhancing accessibility for individuals with hearing impairments.
• Sonix.ai is an automated transcription service that supports multiple languages. It transcribes audio and video files quickly, facilitating the creation of accessible content through transcripts and subtitles.
• Trint provides AI-generated transcriptions with an interactive editor, allowing users to refine transcripts efficiently. This service is beneficial for creating accessible content, as it supports multiple languages and integrates with various platforms.

Steps to Ensure Compliance for Your Audio and Video Content

1. Review Auto-Generated Captions: If using YouTube (or an AI service), review and edit auto-generated captions for accuracy. Don’t rely solely on automatic features; inaccuracies could lead to non-compliance.
2. Add Descriptive Captions: Make sure captions aren’t just a transcription of speech. Include descriptions of non-verbal sounds that are essential to understanding the content (e.g., “[applause]” or “[laughter]”).
3. Create Accurate Transcripts: For audio-only content, provide a clear and accurate transcript. This can be done using services like GoTranscript or Vook.ai, but it should always be reviewed for accuracy.
4. Include Audio Descriptions: If your video contains visual elements that are important to the message, consider adding an audio description track to narrate these elements.
5. Regularly Review ADA Standards: The legal landscape around ADA compliance is evolving, and staying informed about changes can help you avoid issues. Regularly check the WCAG guidelines and consult legal resources or accessibility experts when needed.

Conclusion

Creating accessible audio and video content is essential for municipalities and businesses alike. While YouTube’s accessibility features are a helpful starting point, they may not meet all ADA requirements, and relying solely on them could be risky. Utilizing professional or automated transcription services, like GoTranscript or Vook.ai, can help ensure your content is accessible and compliant. By taking a proactive approach to accessibility, you’re not only adhering to legal standards but also fostering inclusivity within your community.

For those seeking more information on how to make their digital content ADA-compliant or looking for affordable services to help, CourseVector offers comprehensive solutions tailored to your needs. Reach out today to learn how we can assist in making your online presence accessible to all.

Benefits of Using the Worksheet

• Comprehensive Coverage: Ensures all vital aspects of your municipality are represented on your website, from historical landmarks to government services.
• Time-Saving: Streamlines the content gathering process, allowing you to organize information efficiently and effectively without missing critical details.
• Customization: Offers the flexibility to highlight unique features and events specific to your community, making your website stand out.
• Ease of Use: Designed with user-friendliness in mind, the worksheet guides you through each step, making it easy for anyone in your administration to contribute.
• Future Updates: Facilitates the process of updating your website by having all your content elements organized and accessible for future revisions.

How to Use the Worksheet Effectively

1. Access the Form: Start by accessing the worksheet online. Ensure you have the necessary permissions to edit and save information.
2. Fill Out Each Section Carefully:
   • Website URL and Welcome Message: Enter the URL of your municipal website and craft a welcoming message for visitors.
   • Community Details: Provide insights into your community, including historical landmarks and notable events.
   • Government Information: List your council members and relevant government committees.
   • Services and Departments: Detail the public services and departments within your municipality.
3. Add High-Quality Images: Use the file transfer system to upload images that represent your municipality well, especially for historical landmarks and events. https://transfer.coursevector.com/
4. Consult with Colleagues: If possible, collaborate with other members of your team to ensure all information is accurate and comprehensive.
5. Not sure about a section? Contact us! That’s what we’re here for. To make this process easy for you.
6. Review and Submit: Once you’ve filled out all sections, review the information for accuracy and completeness. Make any necessary edits before submitting.

Municipality Web Design Program

At CourseVector, we take pride in our active involvement with the Pennsylvania State Association of Boroughs (PSAB) and our extensive experience in helping boroughs thrive online. We understand the critical need for municipalities to maintain an up-to-date web presence that effectively communicates with residents, businesses, and visitors. Our tailored Web Design Program, coupled with exclusive discounts for PSAB members, ensures your community stays informed and engaged. Contact us today to leverage our expertise in building a professional municipal website that encompasses everything from community events to zoning ordinances.

Learn more about our specialized services and the benefits of partnering with us for your web design needs.