PCI compliance for small business, explained

PCI stands for Payment Card Industry. PCI compliance means following the card industry's security standard. That standard is the PCI DSS. It covers how you handle cardholder data. The card brands wrote it. It applies to every business that accepts cards. That runs from a one-terminal coffee shop to a chain. No government agency enforces it. The card networks do, through your processor.

For most small businesses this is far less scary than it sounds. Say you take cards on a modern terminal or POS that encrypts the data. Then you are not storing card numbers yourself. Proving compliance is mostly a yearly questionnaire that says so.

Here is the part that costs real money. It is the PCI non-compliance fee. When your compliance paperwork is not done, many processors quietly add a monthly charge. It runs $10 to $40, sometimes more. It is one of the most common junk fees we find when we read a statement. Merchants often pay it for years. They do not know what it is, or that finishing a form makes it go away.

Worth being clear: that fee is not the cost of being secure. It's a charge for not having turned in your homework. Complete the assessment and it should come off the next statement.

Find your SAQ.SAQ is short for Self-Assessment Questionnaire. There is more than one, and the right one depends on how you take cards. A swipe-only countertop terminal gets a much shorter form. A website that handles card numbers gets a longer one. Your processor's compliance portal points you to yours.

Answer it accurately and run a scan if needed. Most small businesses that take cards in person fill out a short questionnaire and are done. Do you key cards into a computer? Do you run your own online checkout? Then you may also need a quarterly network scan. The portal can run that scan for you.

Shrink your scope with the right equipment. The best single move is using terminals and a setup that encrypt card data right at the point of sale. Card numbers then never touch your computers or your network. Less exposure means a shorter questionnaire and less to worry about.

None of this needs a broker. But it is the kind of small, annoying task that quietly costs you until someone handles it. When we read your statement, the PCI non-compliance fee is one of the first things we look for. We put you on equipment that keeps card data out of your systems. We point you to the right questionnaire and help you get it done. Then we check that the fee drops off. It is a small thing. It is easy to ignore and easy to fix.