What is PCI compliance?

PCI compliance means meeting the Payment Card Industry Data Security Standard (PCI DSS), the security rules every business that accepts, processes, stores or transmits card data is expected to follow. Most small and mid-size merchants show compliance by completing a yearly self-assessment questionnaire and, depending on their setup, passing regular network vulnerability scans.

If you have ever wondered what is PCI compliance and why a line for it shows up on your processing statement, this guide is for you. We cover who sets the rules, who they apply to, what you actually have to do and how to keep the process from turning into a monthly charge.

Who sets the PCI rules

PCI DSS is managed by the PCI Security Standards Council, a group founded by the major card brands, including Visa, Mastercard, American Express and Discover. The Council writes and updates the standard. The card brands decide how it is enforced, and they rely on acquiring banks and processors to make sure their merchants comply.

That chain matters. You don’t file anything with the card brands directly. Your processor asks you to show compliance, usually through an online portal, and reports on its merchants as a group. That is also why processors handle PCI so differently: some help you through it, and some simply bill you when it isn’t done.

Who PCI applies to

If your business accepts card payments in any form, PCI DSS applies to you. That includes:

• A shop with one countertop terminal
• A restaurant with a POS system and handheld devices
• An online store using a hosted payment page
• A medical office taking card payments by phone
• A business that keeps cards on file for recurring billing

What changes from one business to the next is how much of the standard applies. A merchant whose card data never touches its own systems has far less to cover than one that handles card numbers directly. Merchants are also grouped into levels by transaction volume. Most small businesses fall in the lowest levels and can self-assess, while the largest merchants face more formal assessments.

What PCI DSS covers

The standard is detailed, but its goals are easy to understand. In plain terms, it asks you to:

Goal	What it means for a merchant
Protect your network	Use firewalls, change default passwords and keep payment devices off open networks
Protect card data	Don’t store card data you don’t need, and encrypt it when it travels
Manage weaknesses	Keep software updated and use anti-malware protection
Control access	Give card data access only to people who need it, with their own logins
Monitor and test	Watch for unusual activity and test your security regularly
Keep a security policy	Write down how your business handles card data and train staff on it

Most merchants don’t meet every line of the standard themselves. When you use encrypted terminals, a hosted payment page or tokenization, your provider carries much of the load and your share shrinks. Our guide to tokenization and encryption explains how that works.

What you actually do each year

For most small and mid-size merchants, PCI compliance is a yearly routine:

1. Identify how you accept cards. Terminal, POS, online, phone or a mix.
2. Choose the right self-assessment questionnaire (SAQ). Your setup decides which one applies. See PCI SAQ types explained.
3. Answer the questionnaire honestly. Fix anything you can’t answer “yes” to.
4. Complete network scans if your SAQ requires them. These are run by an approved scanning vendor.
5. Submit and keep records. Your processor confirms you are compliant.
6. Repeat next year, and update whenever you change equipment or how you take payments.

Our PCI checklist for small business turns this into a list you can work through.

Why it matters

PCI compliance is not just paperwork. The practices it requires make card data harder to steal. If card data is compromised at a business that wasn’t compliant, the costs can include card-brand assessments, the cost of a forensic investigation, card replacement costs and damage to your reputation. Exact consequences vary by situation and by card brand.

There is also a monthly cost many merchants don’t notice. A lot of processors charge a non-compliance fee every month the questionnaire isn’t done. It doesn’t make anyone safer. It just adds a line to your statement. Our guide to non-compliance fees covers how to spot it.

Common myths

• “My processor handles PCI for me.” Your providers can reduce your share, but you still complete your part.
• “We’re too small to be a target.” Small businesses are often targeted precisely because their defenses are thinner.
• “A new chip terminal made us compliant.” It helps, but your network, staff habits and paperwork still count.
• “PCI is a one-time certificate.” It is a yearly routine that also needs a fresh look whenever your setup changes.

This guide gives a general overview of PCI DSS. Requirements depend on your setup and the version of the standard in effect. Check current requirements with your processor or a qualified assessor.

What PayZoom does

PayZoom offers PCI compliance help without non-compliance fees. We help merchants meet Visa and Mastercard rules and stay PCI compliant instead of billing them for falling behind. A real person walks through the questionnaire with you, helps you choose the right SAQ and suggests setup changes that keep card data out of your systems.

When you need more, PCI audits and PCI insurance are available through PayZoom. Start with a free statement analysis to see whether you are paying a non-compliance fee today, or call 866.242.4325 to talk with a real person.