How To Become PCI Compliant

The Payment Card Industry Data Security Standard applies to every business that accepts credit or debit cards, from a one-register shop to a hospital. That sounds daunting, and the full standard, now in its version 4 form, runs to several hundred pages. The good news is that how much of it applies to you depends almost entirely on how you take cards, and a small business that makes one good decision at the start can keep its obligations to a short questionnaire and some sensible housekeeping. This guide walks through it in order.

What the standard asks

PCI DSS has twelve requirements grouped under six goals: build and maintain a secure network; protect cardholder data; maintain a vulnerability management programme; implement strong access control; monitor and test networks regularly; and maintain an information security policy. In plain terms: a proper firewall, no default passwords, encryption where card data moves or rests, patching, antivirus, limited access with unique logins, logging, testing, and written policies with trained staff. Most of it is what a well-run business does anyway; the standard makes it evidence.

Step 1: shrink the scope

Scope is everything that stores, processes or transmits card data, plus anything connected to it. The single most effective thing a small business can do is keep card data out of its own systems entirely:

• Use point-to-point encrypted terminals from your processor, so the card number is encrypted inside the device and your network never sees it.
• Use a hosted payment page for online sales, so the customer types the card into your processor’s page, not yours.
• Use the processor’s app for field payments on phones and tablets, and for cards taken over the phone, instead of writing numbers down or keying them into a spreadsheet.
• Never store card numbers in email, notes, recordings or a CRM. If you cannot find any, you cannot lose any.

Do this and most of the twelve requirements no longer apply to you, because the data is not there.

Step 2: pick the right questionnaire

Businesses below the highest transaction volumes self-assess using a Self-Assessment Questionnaire, and there are several versions matched to how cards are taken. The main ones for a small business:

• SAQ A: online sales fully outsourced to a hosted payment page. The shortest.
• SAQ B or B-IP: standalone card terminals, either dial-up or connected to the internet but isolated from everything else.
• SAQ P2PE: terminals using a validated point-to-point encryption solution. Short, and the usual answer for restaurants, clubs, clinics and shops.
• SAQ C or C-VT: payment applications or a virtual terminal running on a computer that is connected to the internet. Longer, because your computer and network are now in scope.
• SAQ D: everything else, including anyone who stores card data. The full standard.

Your processor will tell you which applies, and it depends entirely on the choices in step 1. Moving from SAQ D to SAQ P2PE is the difference between a project and an afternoon.

Step 3: meet what remains

Even on a short questionnaire, some things stay yours:

1. A managed firewall with the payment terminals on their own network segment, away from the office computers, guest Wi-Fi and cameras. See our network support.
2. No default passwords on terminals, routers, the wireless network or anything else.
3. Patching on a schedule and endpoint protection on every computer, especially any that touches payments; see our guide to antivirus for a business.
4. Unique logins and multi-factor authentication for anyone who can reach payment systems or the network they sit on.
5. Logs kept and reviewed, which a managed firewall and endpoint service produce for you.
6. A short written policy and staff who know not to write card numbers down and how to spot a fake “processor support” call.
7. Quarterly external scans by an approved scanning vendor, if your questionnaire type requires them.

Step 4: attest, every year

Complete the questionnaire, sign the attestation of compliance, and submit it through your processor’s portal, usually with the scan results attached. Put next year’s date in the calendar; compliance lapses quietly, and the first anyone hears of it is a non-compliance fee on the statement or a breach investigation that asks for the paperwork.

What happens if you do not

Non-compliance is enforced by your processor: monthly fees, higher rates, and after a breach, fines and the cost of forensic investigation and card reissuance passed down to you. A small business can lose the ability to take cards at all. Cyber insurers ask about PCI status too; the cyber insurance readiness check shows the overlap.

Who this affects most in the Twin Cities

Restaurants and retail, obviously, but also service companies taking payments in the field, such as HVAC companies, private clubs with a pro shop and a dining room, clinics, and any office that takes a card over the phone. The pattern is the same in every case: keep the card number inside the processor’s device or app, keep that device on its own network, and the questionnaire stays short.

Common questions

Is PCI compliance a law?

No. It is a contractual requirement from the card brands, enforced through your bank or payment processor. The consequences of ignoring it are real, though: fines passed down by the processor, higher fees, liability for a breach and, in the worst case, losing the ability to take cards.

How often do we have to do it?

Every year: a self-assessment questionnaire and an attestation, and for some questionnaire types a network scan by an approved vendor every quarter. Your processor’s portal usually tells you the due date.

Does using Square, Stripe or a hosted checkout make us compliant?

It makes it much easier. If card data never touches your systems, you qualify for the shortest questionnaire and most requirements do not apply to you. You still have to complete and sign it, and you still have to keep your own network and staff practices sound.

What is an ASV scan?

An external vulnerability scan of your internet-facing systems by an Approved Scanning Vendor, required quarterly for businesses whose card handling touches their own network. If your firewall is exposing something it should not, the scan finds it before a criminal does.

Does PCI cover a phone system or a tablet in the field?

If card numbers are read over the phone or typed into a device, yes. The usual fix is the same: use the processor’s app or terminal so the number goes to them directly and never sits in your email, your notes or your recordings.

Talk to us

If your processor has sent a questionnaire and nobody knows which boxes to tick, we will work through it with you and fix what needs fixing. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.