PCI DSS Compliance for Small Business: What You Actually Need to Do

The Short Version: Use Stripe and You Are 90% Done

Let me save you 1,000 words of anxiety: if you use Stripe, PayPal, Square, or Braintree to handle credit card payments on your website, you have already outsourced the hardest parts of PCI DSS compliance. These payment gateways are PCI DSS Level 1 certified (the highest level), and they handle card data so you never have to.

The critical distinction is between handling card data and redirecting customers to someone who handles it. If your checkout page redirects to Stripe or uses Stripe's embedded checkout (where the card number fields are hosted by Stripe), your website never touches card data. This is the "easy mode" of PCI compliance, called SAQ A — a 22-question self-assessment instead of a 329-question audit.

What PCI DSS Actually Requires

The full standard has 12 requirements across 6 control objectives. Here is what they mean for a small business in plain English:

1. Install and maintain a firewall. Use Cloudflare (free) on your website. Use a router with a built-in firewall for your office network. Document your firewall rules.
2. Do not use vendor default passwords. Change every default password on every device — routers, POS terminals, WiFi access points, IP cameras. Use a password manager to generate unique ones.
3. Protect stored cardholder data. If you do not store card data (which you should not), this requirement is mostly satisfied. If you do store it, it must be encrypted with AES-256 and access must be strictly limited.
4. Encrypt card data in transit. HTTPS everywhere. That means an SSL certificate on your website, encrypted WiFi, and never emailing full card numbers.
5. Use and regularly update antivirus. Windows Defender counts. Enable automatic updates.
6. Develop and maintain secure systems. Keep your CMS, plugins, and operating system updated. Remove unused software.
7. Restrict access to card data by business need-to-know. Your marketing person does not need to see full card numbers. Nobody needs to see full card numbers.
8. Assign a unique ID to each person with computer access. No shared logins. Every employee has their own account.
9. Restrict physical access to cardholder data. Lock the server room. Lock the office. Do not leave POS terminals unattended.
10. Track and monitor all access to network resources and card data. Turn on logging. Review it occasionally. Know who accessed what.
11. Regularly test security systems. Run quarterly vulnerability scans if you are SAQ C or D. Use a free tool like OpenVAS or pay an Approved Scanning Vendor (ASV) — typically $200-500/year.
12. Maintain an information security policy. Write down your security rules. It does not need to be long — a 3-page document covering passwords, access, updates, and incident response is sufficient.

The Self-Assessment Questionnaire (SAQ)

The SAQ is how you prove PCI compliance. It is a checklist of yes/no questions about your security practices. Most small businesses complete SAQ A (22 questions) because they use a hosted payment page. You fill it out once a year, keep it on file, and provide it to your payment processor or bank if they ask.

Key questions from SAQ A that trip up small businesses:

• "Do you have a firewall installed and configured?" — Cloudflare counts. Document that you use it.
• "Do you have a written information security policy?" — Write one. A 3-page document is enough.
• "Do you restrict access to cardholder data to only those who need it?" — If you never see card data, answer yes and explain that your payment gateway handles it.

In-Person Payments: Your POS Terminal

If you accept cards in person, your POS terminal (the card reader) also needs to be PCI compliant. The good news: almost all modern terminals are. Use EMV chip readers (not magstripe-only), ensure the terminal is from a PCI-certified manufacturer (Square, Clover, Dejavoo all are), and verify that your terminal's firmware is set to auto-update.

Never write down customer card numbers on paper. Never store card numbers in a spreadsheet. Never email full card numbers. These are PCI violations and common causes of breaches at small businesses.

The Bottom Line

PCI DSS sounds terrifying, but for most small businesses the practical reality is simple: use a hosted payment gateway, keep your website updated, change default passwords, enable HTTPS, and fill out an annual self-assessment. That covers 95% of what a typical small business needs to do.