PCI DSS compliance for SMBs: what your bank expects when you take cards.
Take card payments? Keep your yearly security check short, correct and on time.
Does it apply to you?
Four questions to see what applies.
PCI DSS is not a law. It is the card industry’s security standard, and your bank or payment provider makes it part of your contract. The details are in the section for your IT manager, below.
- Do you take card payments?In a shop, online or by phone. Then PCI DSS applies to you through your contract with your bank or payment provider.
- Does a provider such as Stripe or PayPal host the payment page?Usually that means the shortest questionnaire. If your own website loads the payment form, the checks get much longer.
- Do you keep card numbers yourself?Then much more of your IT must meet the standard. Often the cheapest fix is to stop keeping them.
- Has your bank asked for a questionnaire or a scan?Then a deadline is running. Filling in the wrong questionnaire is a common and avoidable failure.
What changes for you
One yearly check, kept as small as your set-up allows.
Most small merchants prove they meet PCI DSS once a year with a self-assessment questionnaire, sometimes with a quarterly scan of their website. Which questionnaire you fill in depends on how card data reaches you.
The work grows with every system that touches card data. Payments handled entirely on your provider’s page keep it short. If card data passes through your own systems, far more of your IT has to meet the standard.
The real risk is a breach: your bank can pass on penalties, and you may pay for the investigation and the fraud. The fix is to keep card data away from your systems where you can, and show that the rest is protected.
What to do first
Confirm the right questionnaire, then shrink what it covers.
What we deliver
- The right questionnaire for how you take payments, confirmed before any work starts
- A plan to keep card data out of as many systems as possible
- Your gaps against the standard, ranked, with your IT provider’s fixes tracked
- A yearly calendar of questionnaire, scans, tests and staff training
- Re-use of your ISO 27001 work, if you have it
Who does what
We lead the compliance work. Your IT provider keeps the technical side.
What we lead
- Confirm which questionnaire applies to you
- Work out what is in scope, and how to shrink it
- Rank the gaps and track the fixes
- Prepare the yearly questionnaire with you (you sign it)
- Coordinate scans, tests and staff training
What stays with your IT provider
- Set up multi-factor authentication, logging and updates
- Fix the technical gaps
- Work through the scan findings with the approved scanning vendor
We check the evidence against the plan, and work alongside an external assessor if your bank requires one.
How it starts
Your first step: confirm what applies.
In about three weeks you know which questionnaire is yours, what is in scope and which gaps to close first. The rest follows your bank’s yearly calendar.
- Price
- Fixed fee
- Duration
- About 3 weeks
Fixed quote after the free call.
book a free 25-minute consultationFor your IT manager, DPO or CFO
What PCI DSS asks of you, requirement by requirement.
- 01Req 1
Network security controls
Firewalls, routers, documented network connections — including documented diagrams of the CDE and segmentation.
- 02Req 2
Secure configurations
No vendor defaults, hardening baselines applied to all systems in scope.
- 03Req 3
Protect stored account data
Minimise storage, strong cryptography for primary account numbers (PANs).
- 04Req 4
Protect data in transit
Encryption over public networks, certificate management, deprecation of weak protocols.
- 05Req 5
Protect against malicious software
Anti-malware deployment with phishing awareness controls (new emphasis in v4.0).
- 06Req 6
Develop & maintain secure systems
Patching cadence, secure development, payment page script management (new in v4.0 — Req 6.4.3).
- 07Req 7
Restrict access to system components
Need-to-know basis, privileged access management, role-based access controls.
- 08Req 8
Identify users & authenticate access
Unique user IDs; MFA required for all access into the CDE (new in v4.0); strong password policy.
- 09Req 9
Restrict physical access
Control to sensitive areas, media protection, visitor management.
- 10Req 10
Log & monitor all access
Audit all access to system components and cardholder data; protect logs from modification.
- 11Req 11
Test security regularly
Quarterly vulnerability scans (ASV), annual penetration testing, segmentation testing.
- 12Req 12
Information security policy
Risk assessments, roles documentation, third-party management, formal awareness program (Req 12.6).
Fines run monthly. Then come the breach costs.
Non-compliance combined with a breach is the worst-case scenario. Your acquiring bank can place you in a non-compliance programme and pass on contractual penalties, which can recur monthly until you comply. Add forensic investigation costs, card replacement for affected cardholders, fraud-loss liability, potential blacklisting from card brand networks, and — if EU residents are affected — GDPR breach notification obligations on top.
Completing the wrong SAQ is itself a compliance failure. We confirm the right SAQ before any work begins, and use proper CDE segmentation to keep your engagement at the simplest applicable level.
Acquirer penalties
Contractual
set by your bank and the card brands, not published — often recurring until you comply.
Quarterly ASV scans
Mandatory
for Levels 1, 2, 3 — and often required of Level 4 by the acquirer.
ISO 27001 overlap
Significant
shared controls (access, encryption, vulnerability management, policy) — no need to start from scratch.
Typical timeline
Continuous program. Annual validation is the formal milestone; controls run year-round.
Weeks 1–3
Scope & gap analysis
CDE definition, segmentation review, SAQ confirmation, gap analysis against the 12 requirements.
Months 2–4
Remediation
Your IT team or provider closes the gaps — MFA into the CDE, payment-page script management, log management; we prioritise, track and check the evidence, and run the awareness programme.
Annually
Validation cycle
SAQ submission, annual penetration test, awareness training refresh, policy review.
Quarterly
ASV scans
External vulnerability scanning by an Approved Scanning Vendor; remediation of findings before passing scan.
FAQ