PCI DSS for Small Businesses: What You Need to Do If You Take Card Payments

What PCI DSS is

The Payment Card Industry Data Security Standard is a set of security requirements created by the major card brands and maintained by the PCI Security Standards Council. It applies to every organisation that stores, processes or transmits cardholder data, from a market stall with a card reader to an online shop. It is not a law, but it is enforced through your agreement with the bank or provider that processes your payments.

For small businesses, the goal is to understand how you take payments, minimise the amount of card data you ever touch and complete the validation your provider requires.

How you take payments determines your workload

The amount of work depends on the setup. A business using a standalone payment terminal connected through a validated provider has a very different task from one that built its own checkout and stores card numbers. Ask your payment provider or acquiring bank which Self-Assessment Questionnaire applies and what they expect of you.

• Hosted payment page or redirect: customers enter card data on the provider's site, which keeps most of the burden off you
• Embedded payment fields from a validated provider: lighter than a custom form, though your page scripts still matter
• Your own payment form posting to your server: much heavier scope and best avoided
• Card terminals and point-of-sale systems: secure the devices, network and staff procedures
• Phone or mail orders: protect recordings, notes and paper forms that contain card numbers

Shrink your scope on purpose

The most effective strategy is to make sure card data never enters your systems. Use a reputable provider with hosted checkout or tokenisation, where the provider keeps the card number and gives you a harmless token. Do not write card numbers in emails, spreadsheets, chat messages or notes, and train staff to refuse them by those routes.

Separate payment devices from the rest of your network if you can, and avoid using the same computers for payments and general browsing. Removing something from scope is cheaper than defending it.

Core security expectations

The standard has twelve principal requirements grouped under six goals. Even if you complete a short questionnaire, the themes are familiar security practice.

• Maintain a firewall and secure configuration, with no default passwords
• Protect stored account data and encrypt transmission over open networks
• Keep systems patched and protected against malware
• Restrict access to cardholder data to people who need it, with unique IDs and multi-factor authentication
• Log and monitor access, and test security regularly
• Maintain a security policy and train staff

E-commerce specifics

For online shops, the page scripts you load can be as important as the server. Attackers inject skimming code into checkout pages through compromised plugins, themes or third-party scripts. Keep your platform and plugins updated, remove unused ones, limit who can edit the site and monitor for unexpected changes.

Use multi-factor authentication for your hosting, content management system and payment provider accounts. Review which third-party scripts load on checkout pages, and remove marketing tags that are not needed there. Newer versions of the standard pay particular attention to payment page scripts, so check the current requirements with your provider.

Questions to ask your payment provider

Your provider knows its own platform better than anyone, so use that expertise. A short conversation or email can clarify a great deal.

• Which Self-Assessment Questionnaire applies to the way I take payments?
• Is the provider listed as PCI DSS validated, and where can I see evidence?
• Does card data ever pass through my website or servers?
• What do I need to do to secure my terminals and my network?
• Are there fees for non-compliance or for late validation?
• What should I do immediately if I suspect a breach?

Paperwork and next steps

Find your merchant agreement or call your acquirer to learn how to submit validation. Complete the correct questionnaire honestly, keep copies and set a yearly reminder. Record where card data could appear in your business, including old paper files.

If a breach happens, tell your acquirer promptly and follow their instructions. Good records of what you did to protect data will help. Treat PCI as part of a wider security routine rather than a form to fill in once a year.