Learn / Small business security
Payment card security and PCI DSS in plain terms
What PCI DSS is, why it applies to almost every business that takes cards, and how to shrink your obligations by never touching card data.
What PCI DSS is
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements for any organization that stores, processes or transmits payment card data. It is maintained by the PCI Security Standards Council, founded by the major card brands. It is not a government law, but your agreement with your bank or payment provider (the "acquirer") requires you to follow it, and failing to can bring fees, higher transaction costs or loss of the ability to take cards.
The current major version is PCI DSS 4.0, released in 2022, with a minor revision, 4.0.1, published in 2024. The older version 3.2.1 was retired in 2024, and the new requirements that were "future-dated" in version 4.0 became mandatory in 2025.
What counts as card data
- Cardholder data: the card number (called the PAN), plus cardholder name and expiry date when stored with it.
- Sensitive authentication data: the full magnetic stripe or chip data, the security code on the card (CVV2, CVC2 and similar), and PINs. These must never be stored after a payment is authorized, even encrypted.
Never write card numbers on paper, store them in spreadsheets, or accept them by email or chat. Those habits pull your whole office into scope.
How to shrink your scope
The smartest PCI strategy for a small business is to make sure card data never touches your own systems:
- In person: use a terminal from your payment provider that encrypts the card at the moment it is read (point-to-point encryption, or P2PE, if available). The data passes straight to the processor.
- Online: use a hosted payment page or embedded payment fields from a reputable provider, so the customer types card details into the provider's page, not your web server.
- Phone orders: key them into the provider's terminal or virtual terminal, never into your own systems, and never record calls that capture card numbers.
When you outsource card handling this way, your compliance work drops from hundreds of requirements to a much shorter questionnaire.
Self-assessment questionnaires
Most small merchants prove compliance with a Self-Assessment Questionnaire (SAQ) once a year. Which one depends on how you take cards:
| How you take cards | Typical SAQ | Size |
|---|---|---|
| Fully outsourced e-commerce (hosted page or redirect) | SAQ A | Shortest |
| E-commerce where your site controls the payment page script | SAQ A-EP | Longer |
| Standalone dial-up or cellular terminals, no electronic storage | SAQ B | Short |
| Validated P2PE terminals | SAQ P2PE | Short |
| Payment software on connected systems | SAQ C | Medium |
| Anything else, including storing card data | SAQ D | Longest |
Your payment provider tells you which applies and often offers a portal to complete it. Larger merchants, defined by annual transaction volume, may need an outside assessor instead.
Everyday protections that matter
- Inspect terminals for skimmers and tampering, especially self-service terminals. Keep a list of terminal serial numbers.
- Keep the payment page clean. Attackers inject scripts into checkout pages to copy card details as customers type, so keep website plugins updated and limit who can change the site. PCI DSS 4.0 added specific requirements for managing scripts on payment pages.
- Change default passwords on routers and any payment-related devices.
- Separate the card terminal network from guest Wi-Fi.
- Train staff to refuse card numbers by email and to report suspicious terminal "maintenance" visits that were not arranged.
What happens after a card breach
If cards used at your business show up in fraud, the card brands can trace a "common point of purchase" back to you. You may face forensic investigation costs, fines passed on by your acquirer, card replacement costs and reputational damage. The Target breach, which began with malware on point-of-sale systems, is the best-known example of how costly this can become.
This is a plain-language summary for education. Your payment provider and the PCI Security Standards Council publish the authoritative requirements.
