A PCI checklist for small business.

A PCI checklist for small business covers five areas: knowing how card data moves through your business, choosing the right self-assessment questionnaire, securing your devices and network, training your staff and repeating the process every year. Most small merchants can work through it in a few sittings, especially when their card data stays inside encrypted terminals or hosted payment pages.

Use this as a working list, not a replacement for your actual questionnaire. The PCI Data Security Standard is updated over time, so your official SAQ is the final word. If you need the background first, read what is PCI compliance.

Step 1: Map how you take cards

You can’t protect what you haven’t listed. Write down every way card data enters your business:

• Countertop terminals and which network or phone line they use
• POS stations, tablets and handheld devices
• Your website checkout and the provider behind it
• Virtual terminals used for phone or mail orders
• Cards kept on file for recurring billing
• Any paper forms, order slips or notes that capture card numbers

Don’t forget the less obvious places. A shared office computer used to log in to the gateway, a tablet used for curbside orders or a voicemail box where customers leave card numbers all count. So do third parties: if a booking system, ordering app or answering service touches card data for you, list them and ask how they handle PCI.

Then note where card data could end up: computers, email, spreadsheets, filing cabinets or call recordings. The goal is to find card data you don’t need and get rid of it.

Step 2: Pick the right questionnaire

Your map decides which self-assessment questionnaire (SAQ) applies. A business using only standalone terminals has a much shorter list than one with an internet-connected POS and an online store that builds its own payment page. Our guide to PCI SAQ types lays out the options. When in doubt, ask your processor before you start answering questions.

Step 3: Secure your devices and network

This is where most of the practical work lives. Go down the list and check each item:

Item	What good looks like
Default passwords	Changed on every router, terminal, POS and admin account
Wi-Fi	Guest Wi-Fi kept separate from the network your payment devices use
Firewall	In place between your payment systems and the internet
Software updates	POS, operating systems and browsers kept current
Anti-malware	Running on computers that touch payment systems
User logins	Each person has their own login, with access only to what they need
Terminals	Checked regularly for tampering or added devices
Remote access	Turned off when not needed, and protected when it is

Encrypted terminals and tokenization reduce how much of this applies to you, because card data is unreadable or never present in your systems. Our guide to tokenization and encryption explains how they shrink your scope.

Step 4: Handle card data with care

Good habits close the gaps technology can’t. These are the ones that matter most for small businesses:

1. Don’t write card numbers down. If a phone order comes in, key it straight into the terminal or virtual terminal.
2. Never store security codes. The three or four digit code on a card should never be kept after authorization.
3. Don’t email or text card numbers. Ask customers not to send them that way, and delete any you receive.
4. Shred what you no longer need. Old forms with card data should be destroyed, not filed.
5. Limit who can see card data. Only staff who need it should have access.
6. Train your staff. Teach them to spot tampered terminals, phishing emails and callers posing as tech support.

A two-minute terminal check

Once a week, or at each shift change for busy counters, look over each terminal. Check that the serial number matches your records, that there are no loose parts, extra wires, overlays on the card slot or keypad, and that the device is where it should be. Skimming devices are designed to blend in, so comparing against a photo of the untouched terminal helps. If anything looks off, stop using that device and call your processor.

Many of these also reduce fraud risk. See card fraud prevention for more on that side.

Step 5: File, scan and repeat

Once the work is done, finish the paperwork and set yourself up for next year:

• Complete your SAQ honestly. If an answer is “no,” fix the gap before you submit.
• Run external network scans through an approved scanning vendor if your SAQ requires them, often quarterly.
• Submit your SAQ and any scan results through your processor’s portal.
• Write a short security policy describing how your business handles card data, and share it with staff.
• Set a calendar reminder for next year’s renewal and for any scans.
• Revisit the checklist whenever you add a location, switch POS systems, launch online sales or change providers.

This checklist is a general guide. Your official SAQ and your processor’s instructions set the actual requirements for your business, and the standard changes over time.

What PayZoom does

PayZoom offers PCI compliance help with a real person on the phone, not just a portal login. We help you map your setup, choose the right SAQ and work through the questions. We also recommend changes, such as encrypted terminals or hosted payment pages, that keep card data out of your systems and shorten your list.

We never charge non-compliance fees. We help merchants stay compliant with Visa and Mastercard rules instead. PCI audits and PCI insurance are available if you need them. Call 866.242.4325 or start with a free statement analysis.