What is PCI compliance?

PCI compliance (Payment Card Industry Data Security Standard) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. It is mandated by the major card brands (Visa, Mastercard, Discover, Amex) to protect cardholder data from theft and fraud.

If your business accepts credit cards, you must be PCI compliant. It is not a suggestion; it is a requirement enforced by the payment networks. Failing to maintain compliance can result in massive monthly fines, liability for fraudulent charges, and the permanent termination of your merchant account.

Despite its importance, PCI compliance is often misunderstood by small and medium-sized businesses. This guide demystifies the PCI DSS (Data Security Standard), explains the different levels of compliance, and provides actionable steps to secure your payment environment and avoid costly penalties.

Table of Contents

  1. What is PCI compliance?
  2. Understanding the PCI DSS Framework
  3. The 4 Levels of PCI Compliance
  4. How to Achieve and Maintain Compliance (The Easy Way)
  5. The Cost of Non-Compliance
  6. Frequently Asked Questions (FAQ)

Understanding the PCI DSS Framework

The Payment Card Industry Data Security Standard (PCI DSS) was created in 2004 by the PCI Security Standards Council (an organization founded by Visa, Mastercard, Discover, American Express, and JCB).

The standard is built around 12 core requirements, organized into six broader goals:

  1. Build and Maintain a Secure Network and Systems: Install and maintain firewalls; do not use vendor-supplied defaults for system passwords.
  2. Protect Cardholder Data: Protect stored cardholder data; encrypt transmission of cardholder data across open, public networks.
  3. Maintain a Vulnerability Management Program: Protect all systems against malware and regularly update anti-virus software; develop and maintain secure systems and applications.
  4. Implement Strong Access Control Measures: Restrict access to cardholder data by business need-to-know; identify and authenticate access to system components; restrict physical access to cardholder data.
  5. Regularly Monitor and Test Networks: Track and monitor all access to network resources and cardholder data; regularly test security systems and processes.
  6. Maintain an Information Security Policy: Maintain a policy that addresses information security for all personnel.

While these 12 requirements sound highly technical, the actual burden on your business depends entirely on how you process payments.

The 4 Levels of PCI Compliance

The PCI Council categorizes merchants into four levels based on their annual transaction volume. Your level determines the strictness of your validation requirements.

  • Level 1: Over 6 million transactions per year. Requires an annual on-site assessment by a Qualified Security Assessor (QSA) and a Report on Compliance (ROC).
  • Level 2: 1 million to 6 million transactions per year. Requires an annual Self-Assessment Questionnaire (SAQ) and may require quarterly network scans.
  • Level 3: 20,000 to 1 million ecommerce transactions per year. Requires an annual SAQ and quarterly network scans.
  • Level 4: Under 20,000 ecommerce transactions per year, or up to 1 million retail transactions. Requires an annual SAQ and quarterly network scans (if applicable).

The vast majority of small to medium-sized businesses fall into Level 3 or Level 4.

How to Achieve and Maintain Compliance (The Easy Way)

If you are a Level 3 or Level 4 merchant, the easiest way to achieve PCI compliance is to never touch the credit card data. You can drastically reduce your PCI scope (the number of systems and processes subject to the 12 requirements) by outsourcing the handling of card data to a PCI-compliant third party.

1. Use Hosted Payment Pages or Client-Side Tokenization

If you run an ecommerce store, do not build your own checkout form that posts data to your server.

  • Hosted Checkout: Redirect the customer to a secure page hosted by your payment gateway (like Authorize.Net or NMI). The gateway handles the data, keeping your servers entirely out of scope.
  • Tokenization (e.g., Stripe Elements): Use client-side tokenization. The customer enters their card on your site, but the data is sent directly from their browser to the gateway. The gateway returns a secure “token” to your server, which you use to process the charge. Because your server only sees the token, your PCI scope is minimized.

2. Never Store Full Credit Card Numbers

There is almost no legitimate business reason for a merchant to store full, unencrypted credit card numbers (PANs) or CVV codes on their own servers, in spreadsheets, or on paper. If you need to charge a customer again (for a subscription or a later shipment), use the secure token provided by your payment gateway.

3. Complete Your Annual SAQ

Even if you outsource your payment processing, you must still validate your compliance annually by completing a Self-Assessment Questionnaire (SAQ).

  • Your payment processor will typically provide access to a PCI compliance portal (like Trustwave or SecurityMetrics).
  • You will answer a series of yes/no questions about your security practices.

If you use hosted checkout or tokenization, you will likely qualify for SAQ A, which is the shortest and easiest questionnaire (often just a few pages).

4. Perform Quarterly Network Scans (If Required)

If your systems connect to the internet and interact with the payment flow (even if you don’t store data), you may be required to have an Approved Scanning Vendor (ASV) perform quarterly vulnerability scans on your IP addresses. Your processor’s PCI portal usually facilitates this.

The Cost of Non-Compliance

Ignoring PCI compliance is a massive financial risk.

  1. Non-Compliance Fees: If you fail to complete your annual SAQ, your payment processor will charge you a monthly non-compliance fee (typically $20 to $50 per month) until you complete it.
  2. Data Breach Fines: If you suffer a data breach and are found to be non-compliant, the card networks will levy massive fines against your acquiring bank, which will immediately pass those fines down to you. These fines can range from $5,000 to $100,000 per month of non-compliance.
  3. Liability for Fraud: You will be held financially liable for all fraudulent charges resulting from the breach, as well as the cost of replacing the compromised credit cards.
  4. Account Termination: Your processor will terminate your merchant account, and you may be placed on the MATCH list, making it nearly impossible to process payments again [1].

Frequently Asked Questions (FAQ)

Is PCI compliance a law?

No, PCI DSS is not a federal law. It is an industry standard mandated by the private credit card networks (Visa, Mastercard, etc.). However, some states (like Nevada and Minnesota) have incorporated PCI compliance into their state laws regarding data security.

Does using an SSL certificate make me PCI compliant?

No. An SSL certificate (HTTPS) encrypts data in transit between the customer’s browser and your server, which is only one small part of the 12 PCI requirements. It does not protect data stored on your server or secure your internal network.

My payment processor says they are PCI compliant. Does that mean I am?

No. While your processor must be compliant (usually Level 1), you as the merchant are still responsible for ensuring that your specific environment (your website, your office network, your employees) is secure. You must still complete your own SAQ.