What Is PCI Compliance — and Why Does It Matter?

PCI DSS — the Payment Card Industry Data Security Standard — is the set of security requirements that every business accepting credit or debit card payments must follow. It was created by the major card networks (Visa, Mastercard, American Express, Discover) to reduce payment fraud and protect cardholder data.

If you accept card payments, PCI compliance is not optional. Non-compliance can result in fines from your acquiring bank (typically $5,000–$100,000 per month), increased processing rates, and in serious cases, loss of your ability to accept card payments entirely. If a data breach occurs and you’re found to be non-compliant, the liability for the breach — including the cost of the investigation and customer notification — can fall on your business.

The good news: for most small and mid-sized businesses, achieving and maintaining PCI compliance is straightforward. Here’s exactly what you need to know.

The 4 Merchant Levels: Which One Are You?

PCI DSS requirements scale based on your transaction volume. The more transactions you process, the more rigorous the requirements.

• Level 1 — Over 6 million Visa or Mastercard transactions per year. Requires an annual on-site audit by a Qualified Security Assessor (QSA).
• Level 2 — 1 million to 6 million transactions per year. Requires an annual Self-Assessment Questionnaire (SAQ) and quarterly network scans.
• Level 3 — 20,000 to 1 million e-commerce transactions per year. Annual SAQ and quarterly scans required.
• Level 4 — Fewer than 20,000 e-commerce transactions, or up to 1 million other transactions per year. Annual SAQ recommended; quarterly scans may be required by your processor.

The vast majority of small and mid-sized businesses are Level 4 merchants. Your payment processor will confirm your level and tell you exactly which requirements apply to you.

The 12 PCI DSS Requirements — in Plain English

PCI DSS is organized into 12 core requirements. Here’s what each one means for your business.

Requirement 1: Install and Maintain a Firewall

Your network must be protected by a properly configured firewall. If you process payments on a computer connected to the internet, you need a firewall between that system and the public internet. For most small businesses, your router’s built-in firewall — properly configured — meets this requirement.

Requirement 2: Don’t Use Default System Passwords

Default passwords on routers, payment terminals, and any other network hardware must be changed before the device goes into service. Attackers specifically target devices using default credentials. Change the password on every device on your network — router, switches, payment terminals.

Requirement 3: Protect Stored Cardholder Data

If you store cardholder data, it must be encrypted and protected. The simplest way to comply: don’t store cardholder data at all. Most modern payment processors and gateways handle tokenization, which means the actual card number is never stored on your servers. If you use a hosted payment page or payment gateway, you likely already meet this requirement.

Requirement 4: Encrypt Cardholder Data Transmitted Over Open Networks

Any time cardholder data moves across the internet, it must be encrypted using strong protocols (TLS 1.2 or 1.3). If your website uses HTTPS (with a valid SSL/TLS certificate), this is largely handled. Make sure your SSL certificate is current and that your website doesn’t fall back to unencrypted HTTP.

Requirement 5: Use and Update Anti-Virus Software

Any system that interacts with cardholder data — including computers used for order management or payment processing — must have up-to-date anti-malware software installed and actively running. Keep it updated automatically.

Requirement 6: Develop and Maintain Secure Systems and Applications

All software and systems must be kept up to date with security patches. For WordPress users, this means keeping WordPress core, themes, and plugins updated. Outdated plugins are one of the most common entry points for attacks on WordPress-based e-commerce sites. Enable automatic updates where possible.

Requirement 7: Restrict Access to Cardholder Data

Only people who absolutely need access to cardholder data should have it. Apply the principle of least privilege — every user and system should have only the access they need to do their job, nothing more.

Requirement 8: Assign Unique IDs to System Users

Every person with computer access to your systems should have a unique login. Shared accounts and shared passwords are not compliant. This makes it possible to track who did what in your systems.

Requirement 9: Restrict Physical Access to Cardholder Data

If you have physical payment terminals or any media (printed records, USB drives) containing cardholder data, they must be physically secured. Terminals should be monitored for tampering. Restrict access to server rooms and areas where payment hardware is stored.

Requirement 10: Track and Monitor All Access to Network Resources

Your systems should log who accesses cardholder data and when. Logs should be retained for at least one year, with three months available for immediate review. For most small businesses, this is handled through your payment processor’s hosted systems — but you should be logging access to your own network and computers as well.

Requirement 11: Regularly Test Security Systems and Processes

Depending on your merchant level, this may require quarterly vulnerability scans performed by an Approved Scanning Vendor (ASV). These scans test your network from the outside for known vulnerabilities. Your payment processor can connect you with approved ASVs. Annual penetration testing is required for higher-level merchants.

Requirement 12: Maintain a Policy That Addresses Information Security

Your business must have a written information security policy that is reviewed and updated at least annually. For small businesses, this doesn’t have to be elaborate — it should document how you handle cardholder data, who is responsible for security, and what happens if there’s a suspected breach.

The Self-Assessment Questionnaire (SAQ): What Most Merchants Actually Need

Level 4 merchants (the majority of small and mid-sized businesses) validate compliance through an annual Self-Assessment Questionnaire. There are several versions of the SAQ — the right one depends on how you accept payments.

• SAQ A — For merchants who only use hosted payment pages (where the payment form is hosted by the processor, not your server). The cardholder data never touches your systems. This is the simplest SAQ — about 22 questions.
• SAQ A-EP — For e-commerce merchants who use a payment page partly or fully on their own servers.
• SAQ B — For merchants using standalone, dial-up payment terminals.
• SAQ C — For merchants with payment applications connected to the internet.
• SAQ D — For all other merchants who store cardholder data or don’t fit the other categories. This is the most comprehensive SAQ — over 200 questions.

If you use a hosted checkout (like what Daystar Payments facilitates through our payment gateway partners), you likely qualify for SAQ A — the simplest path to compliance validation.

Practical Steps to Become and Stay PCI Compliant

Step 1: Understand How You Accept Payments

Map out every way your business takes card payments — your website checkout, any in-person terminals, phone orders. For each one, identify whether cardholder data touches your systems directly or is handled entirely by your processor/gateway.

Step 2: Use a Payment Gateway That Handles the Heavy Lifting

The single most effective thing a small business can do for PCI compliance is to use a payment gateway that handles cardholder data through a hosted payment page or tokenization. This keeps card numbers off your servers entirely, dramatically reducing your PCI scope.

Step 3: Complete Your SAQ Annually

Your processor will send you a reminder. Complete your Self-Assessment Questionnaire honestly. If you’re unsure how to answer a question, contact your processor or a PCI compliance specialist — don’t guess.

Step 4: Run Quarterly Network Scans (If Required)

If your processor requires quarterly ASV scans, schedule them at the start of each quarter so you don’t miss them. Most scans are automated and results come back within hours.

Step 5: Keep Software Updated

Set WordPress, your theme, and all plugins to update automatically. Outdated software is the most common source of website vulnerabilities. If you’re running an e-commerce site, plugin updates should be reviewed monthly at minimum.

Step 6: Train Anyone Who Handles Payment Data

PCI Requirement 12 includes training for employees who handle cardholder data. Even a simple annual reminder about phishing attacks, not writing down card numbers, and reporting suspicious activity satisfies this requirement for most small businesses.

PCI Compliance and High-Risk Merchant Accounts

High-risk merchants — nutraceuticals, supplements, adult content, gaming, travel, and similar industries — are held to the same PCI DSS requirements as any other merchant. But because high-risk accounts are monitored more closely by acquiring banks, compliance matters even more. A data breach on a high-risk account is treated very seriously.

At Daystar Payments, we help our merchants understand their PCI obligations from day one. We work with payment gateway partners who offer hosted payment pages, tokenization, and built-in PCI compliance tools that minimize the compliance burden on your side.

If you’re in a high-risk industry and need a merchant account that makes PCI compliance as straightforward as possible, start your application here or call us at 786.453.7357.

Frequently Asked Questions

What happens if I’m not PCI compliant and there’s a data breach?

The consequences depend on the severity. At minimum, you’ll face investigation costs and potential fines from your acquiring bank and the card networks. If cardholder data was compromised, you may be responsible for reissuing customer cards (typically $5–$15 per card), customer notification costs, and potential legal liability. Non-compliant merchants involved in breaches face significantly higher fines than compliant merchants who experience breaches.

Do I need to be PCI compliant if I use PayPal or Stripe?

Yes — PCI DSS applies to all merchants who accept card payments, regardless of which processor you use. However, if you use a fully hosted solution (where the payment form is entirely on your processor’s servers and card data never touches yours), your compliance scope is much smaller.

How much does PCI compliance cost?

For most small businesses, the cost is minimal. The Self-Assessment Questionnaire is free. Quarterly vulnerability scans from an ASV cost roughly $100–$200 per quarter. Many payment processors include PCI compliance tools and scanning services in their monthly fees. The major cost is only if your merchant level requires a formal audit by a QSA, which applies to businesses processing millions of transactions per year.

How often do I need to validate PCI compliance?

The SAQ is completed annually. Quarterly network scans (if required) are done four times per year. Security patches and software updates should be applied continuously. Your compliance status is technically a continuous obligation, not just a once-a-year checkbox.

What is tokenization and how does it help with PCI compliance?

Tokenization replaces the actual card number with a randomly generated “token” — a string of characters that has no value if intercepted. The token is stored in your system; the actual card number is stored by your payment processor in their secure vault. Because the card number never lives on your systems, your PCI scope is dramatically reduced. Most modern payment gateways offer tokenization as a standard feature.