PCI Compliance for Small Businesses: Requirements, Levels, and Costs

Any business that takes credit or debit cards falls under the Payment Card Industry Data Security Standard (PCI DSS), whether it processes 50 transactions a month or 50,000. Although PCI compliance for small businesses can appear technical, it represents baseline safeguards that must be followed to securely process credit card transactions.

PCI DSS Requirements

PCI Compliance refers to fulfilling the Payment Card Industry Data Security Standard (PCI DSS), a set of global security standards that are designed to ensure that all companies that store, process, or transmit credit or debit card data do so in a safe, protected environment. 

The standard is maintained by the Payment Card Industry Security Standards Council (PCI SSC), which includes major card brands like Visa, Mastercard, American Express, Discover, and JCB.

REQUIREMENTS:

• Build and Maintain a Secure Network & Systems: Install and maintain network security controls (firewalls) and avoid using vendor-supplied default passwords. 

• Protect Cardholder Data: Encrypt stored account data and strongly encrypt cardholder data when it travels across open, public networks.

• Maintain a Vulnerability Management Program: Protect all systems against malware, and regularly update software and security systems. 

• Implement Strong Access Control Measures: Restrict access to cardholder data on a strict “need-to-know” basis, assign unique IDs to every person with access, and restrict physical access to data. 

• Regularly Monitor and Test Networks: Track and log all access to the network resources and cardholder data, and test security systems regularly. 

• Maintain an Information Security Policy: Maintain a strong policy that addresses information security for all personnel. 

Levels of PCI Compliance

Requirements vary depending on how many transactions a business handles per year: 

1. Level 1: Processing over 6 million card transactions per year. Requires an annual Report on Compliance (ROC) by a Qualified Security Assessor (QSA). 

2. Level 2: Processing 1 million to 6 million transactions per year. 

3. Level 3: Processing 20,000 to 1 million e-commerce transactions per year. 

4. Level 4: Processing fewer than 20,000 e-commerce transactions per year. 

PCI Compliance Requirements for Small Businesses

Small businesses that accept, process, store, or transmit credit or debit card data must comply with the Payment Card Industry Data Security Standard. Compliance is contractual (mandated by card brands like Visa, Mastercard, and American Express) rather than direct federal law. 

Small business PCI compliance typically falls under Level 3 or Level 4, depending on their annual transaction volume: 

• Level 3: Businesses processing between 20,000 and 1 million e-commerce transactions.
• Level 4: Businesses processing fewer than 20,000 e-commerce transactions annually, or up to 1 million total transactions across all channels.

The six broad goals outlined break down into twelve specific requirements that PCI DSS compliance for small businesses must put into practice: 

Core Requirements (PCI DSS) 

1. Install and maintain network security controls. 
2. Apply secure configurations and avoid using vendor-supplied default passwords or system parameters. 
3. Protect stored account data and never digitally store sensitive authentication data. 
4. Encrypt cardholder data when transmitted across open, public networks. 
5. Protect all systems from malware by regularly updating antivirus and anti-malware software. 
6. Develop and maintain secure systems and software (passwords can no longer be hard-coded into custom scripts or code). 
7. Restrict access to cardholder data to only those with a strict business need (principle of least privilege). 
8. Identify and authenticate access by assigning unique IDs and enforcing strong passwords (minimum 12 characters with alphanumeric combinations under PCI DSS updates, and mandatory 90-day password changes).
9. Restrict physical access to cardholder data, paper records, and POS terminals. 
10. Log and monitor all access to network resources and cardholder data. 
11. Test security systems regularly (including quarterly network vulnerability scans through an approved scanning vendor). 
12. Maintain an information security policy that addresses all staff and operational procedures. 

Steps to Achieve Compliance

To achieve PCI DSS compliance for small businesses, follow these steps:

1. Determine Scope and Reduce It: 

• Document where card data travels within the business. 
• Use hosted payment processors so the server doesn’t store raw card numbers. 
• Never store CVV/CVC codes, PINs, or full magnetic stripe/chip data, regardless of the circumstances. 

2. Secure Infrastructure and Networks:

• Maintain and configure firewalls to protect all systems that process payment information. 
• Immediately replace all vendor-supplied passwords and admin credentials. 
• Ensure all cardholder data sent across open or public networks is protected with strong cryptography. 
• Regularly update antivirus and anti-malware software on all POS devices and business computers. 

3. Restrict Access and Implement Controls

• Allow only employees with a strict business need to access cardholder data. 
• Give every employee their own unique login ID; never share group or generic account passwords. 
• Require MFA for remote access to the cardholder data environment.
• Lock up physical POS terminals containing card data, and inspect card-swiping devices periodically for tampering. 

4. Complete Self-Assessment Questionnaire (SAQ)

• Identify which self-assessment questionnaire matches the payment setup of the business. 
• Answer the security requirements outlined in the SAQ to verify the controls match PCI DSS standards. 
• Complete and sign the Attestation of Compliance (AOC) form to formally declare the business compliant. 

5. Run Vulnerability Scans 

• If the business processes online or external-facing transactions that require it, have an ASV run quarterly external vulnerability scans on the network. 
• Remediate any security gaps flagged by the scan until receiving a passing report. 

6. Submit Documentation

• Retain the completed SAQ, signed AOC, and any ASV reports. 
• Send the compliance documents to the merchant service provider or acquiring bank if they request proof. 

PCI Compliance for Different Payment Methods

PCI DSS applies equally regardless of how a customer pays, but the practical compliance work varies by channel. 

• In-Person Payments: A business swiping, inserting, or tapping cards at a physical terminal has a smaller data footprint to manage, since chip and contactless technologies encrypt card data at the point of entry. 

• Online Payments: E-commerce transactions carry more risk and more compliance scope, since the card never passes through a physical reader and fraud liability generally sits with the merchant. 

• Phone and Mail Order Payments: Manually keying a card number over the phone carries the same card-not-present risk as an online sale, plus the added challenge of securing the number, however it gets written down or entered through a recorded call, a notepad, or a virtual terminal. 

• Recurring Payments and Subscription Billing: Businesses storing card details for repeat billing take on extra responsibility, since stored data has to be protected on an ongoing basis. 

• Mobile and Contactless Payments: Card readers that plug into a phone or tablet, along with digital wallets like Apple Pay and Google Pay, shift much of the compliance burden to the payment provider, since the card number is tokenized before it reaches the business’s device. 

Cost of PCI Compliance for Small Businesses 

A small, well-organized business can often keep annual compliance costs under a few hundred dollars; one catching up on outdated systems should budget for a larger, one-time remediation expense.

• Self-Assessment Questionnaire: Typically $50 to $200, and often included at no extra charge in a payment processor’s service package.
• Vulnerability Scanning: An Approved Scanning Vendor generally charges $100 to $200 per externally facing IP address scanned.
• Staff Training: Budgeting roughly $70 per employee covers basic security awareness training.
• Remediation: Fixing issues flagged during a scan or assessment, from software patches to replacing outdated POS hardware, can run anywhere from $100 to $10,000 depending on what needs correcting.
• Optional QSA Involvement: A formal assessment by a Qualified Security Assessor averages around $15,000, but this is rarely required at Level 3 or Level 4 unless a processor specifically asks for it.

Consequences of Non-Compliance

Financial Penalties: Card brands fine the acquiring bank for working with a non-compliant merchant, and that cost is passed down to the business, with reported penalties ranging from roughly $5,000 to $100,000 per month until the issue is resolved.

Loss of Payment Processing: An acquiring bank can suspend or terminate a merchant account over continued non-compliance, which means the business can no longer accept card payments at all.

Higher Processing Rates: Processors may raise transaction fees for a business with a history of non-compliance, treating the account as higher risk going forward.

Mandatory Reassessment After a Breach: A business that suffers a data breach can be reclassified to Level 1 regardless of its actual transaction volume, triggering the full QSA audit process.

Reputational Damage: Customers who learn their card data was compromised at a particular business are unlikely to return, and word of a breach spreads quickly in a local market.

PCI compliance isn’t one single task; it’s a set of requirements that need to stay current year-round. Knowing the correct compliance level, completing the right SAQ, keeping checkout pages and access controls current with PCI DSS requirements, and not treating the annual self-assessment as a formality to rush through. The cost of doing this properly is modest for most small operations.

Frequently Asked Questions