PCI Compliance for Small Businesses: A Practical Guide

What is PCI DSS?

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements created by the major card brands and managed by the PCI Security Standards Council. Its goal is simple: keep cardholder data safe wherever it’s handled.

The current version is PCI DSS v4.0.1. It strengthens areas like authentication, monitoring and protecting online payment pages from malicious scripts.

Who needs to comply?

Any business that accepts, processes, stores or transmits payment card data, whatever its size. Your exact requirements depend on your transaction volume and how you accept payments.

Most small and mid-sized businesses fall into the lowest merchant levels and validate compliance by completing a Self-Assessment Questionnaire (SAQ) rather than a full on-site audit.

Which SAQ applies to you?

There are several SAQ types, and the right one depends on how card data flows through your business. Broadly:

• Fully outsourced online payments (for example, a hosted checkout or payment fields served by your provider) usually qualify for the shortest questionnaires.
• Websites that control parts of the payment page have more requirements, especially around script and page security.
• In-person terminals connected to the internet, or validated point-to-point encryption (P2PE) solutions, have their own questionnaires.
• Businesses that store card data or use complex systems face the most extensive requirements.

Your processor can help you identify the right SAQ for your setup.

The core ideas behind the requirements

The full standard is long, but its principles are intuitive:

1. Build and maintain secure networks and systems.
2. Protect stored account data, or better, don’t store it at all.
3. Encrypt card data when it travels over open networks.
4. Keep systems patched and protected against malware.
5. Restrict access to card data on a need-to-know basis, with strong authentication.
6. Monitor and test your systems regularly.
7. Maintain a security policy and make sure your team follows it.

How to make compliance easier: reduce your scope

The most effective PCI strategy for a small business is to keep raw card data off your systems entirely.

• Use tokenization so you store a meaningless token instead of a card number. See our explainer on tokenization vs encryption.
• Use hosted payment fields or checkout so card details go straight to your processor.
• Use encrypted, up-to-date terminals for in-person payments.
• Never write down or email card numbers. Don’t take card details over email or chat, either.

A simple starting checklist

• Confirm which SAQ applies to you and complete it annually.
• Change default passwords on every device and system.
• Use unique logins and multi-factor authentication for anything that touches payments.
• Keep software, plugins and terminals updated.
• Run any required vulnerability scans.
• Train staff to spot phishing and social engineering.