PCI compliance has a reputation for being complicated and expensive, and for large companies that store card data it can be. For most small businesses, though, the actual work is manageable once you understand what applies to you. The biggest lever is simple: the less card data your business touches, the less there is to protect and prove.

What PCI DSS is

The Payment Card Industry Data Security Standard, or PCI DSS, is a set of security requirements for any business that stores, processes or transmits cardholder data. It is maintained by the PCI Security Standards Council, an organization founded by the major card brands. The card brands and acquiring banks, not the government, require merchants to comply as a condition of accepting cards. The standard is revised periodically, so the specific requirements change over time.

Compliance is not a one-time certificate. It is an ongoing state: your systems and practices are expected to meet the standard all year, and you are typically asked to validate that once a year.

Merchant levels and validation

Card brands group merchants into levels, mostly based on annual transaction volume. Larger merchants have more formal validation requirements. Most small businesses fall into the lowest levels and validate compliance by completing a Self-Assessment Questionnaire, or SAQ, and in some cases by passing regular external vulnerability scans performed by an Approved Scanning Vendor. The exact level thresholds and requirements are set by each card brand and can change, so confirm your level and obligations with your processor.

There are several SAQ types, and the right one depends on how you accept cards. Broadly:

  • Businesses whose online payments are fully handled by a third-party payment page, with no card data touching their own systems, generally qualify for the shortest questionnaires.
  • Businesses using standalone terminals that are not connected to other systems have a relatively limited scope.
  • Businesses using a validated point-to-point encryption solution can often use a dedicated, shorter questionnaire.
  • Businesses that key card numbers into a web-based virtual terminal have their own questionnaire.
  • Businesses whose payment systems are connected to other computers or networks, or that store card data, face the broadest requirements.

Shrink your scope first

The easiest way to make PCI compliance simpler is to reduce how much card data your business can see. Two technologies do most of the work:

  • Point-to-point encryption, or P2PE, encrypts card data the moment it is read by the terminal, so your network and computers never see readable card numbers.
  • Tokenization replaces a card number with a random token that is useless to a thief. You can store the token for recurring billing or card-on-file payments without storing the card itself.
  • Hosted payment pages and payment links keep online card entry on the provider's secure page instead of your website.

If you currently write down card numbers, keep them in a spreadsheet or accept them by email, moving to tokenized card-on-file storage is one of the most valuable changes you can make.

Everyday practices that matter

  • Never store the card security code after a transaction is authorized, and never write it down.
  • Do not accept card numbers by email, text or chat. Send a secure payment link instead.
  • Change default passwords on routers, terminals and software, and give each employee their own login.
  • Keep payment devices, computers and software updated.
  • Keep payment devices on a network separate from guest Wi-Fi.
  • Inspect terminals and PIN pads regularly for tampering or added skimming devices.
  • Limit access to payment systems to the people who need it, and remove access when someone leaves.
  • Shred any paper that contains card information.

A simple annual routine

Compliance is easier to maintain when it is part of the calendar rather than a scramble. A routine that works for many small businesses:

  1. Once a year, confirm with your processor which questionnaire applies, and whether anything about how you accept cards has changed.
  2. Walk through every place card data could appear: terminals, computers, phones, paper forms, email inboxes and filing cabinets.
  3. Complete the questionnaire honestly, and fix anything you cannot answer yes to before you submit it.
  4. Complete any required vulnerability scans on schedule and keep the results.
  5. Review who has access to payment systems and remove anyone who no longer needs it.
  6. Remind staff of the basics: no card numbers by email, inspect terminals, report anything unusual.

The PCI non-compliance fee

Many processors charge a monthly fee if you have not completed your annual validation. It often appears on statements as PCI non-compliance, and some businesses pay it for years without knowing what it is. The fix is usually just completing your questionnaire and any required scans. If you see this fee, ask your processor what is missing and how to complete it.

If something goes wrong

If you suspect card data has been exposed, contact your processor right away. They will guide you through the steps the card brands require. Do not try to investigate on your own by turning devices off and on or deleting files, since that can destroy information needed to understand what happened. It also helps to keep a short written plan listing who to call.

How BrightStar helps

When BrightStar sets up an account, we recommend equipment and payment methods that keep your PCI scope as small as practical, and we help you identify and complete the right questionnaire. If you are paying a PCI non-compliance fee today, send us a statement. We will show you how to stop paying it and how our pricing compares, with your rate matched or beaten in writing. And through the BrightStar Impact Network, a share of our profit on your account supports a cause you choose, every month.

Published · BrightStar Merchant Services