PCI DSS for a small business: what applies to you and how to keep it small

The Payment Card Industry Data Security Standard applies to any organization that stores, processes or transmits cardholder data, which means any business that accepts cards. Version 4.0.1 has been fully mandatory since March 31, 2025, with all of the future-dated requirements now in force.

Scope is everything

PCI DSS applies to the systems that touch card data and anything connected to them. The whole standard is easier when that set is as small as possible:

• Hosted checkout online keeps card data on the gateway’s page, not your site. Your questionnaire gets much shorter.
• Point-to-point encrypted terminals in store mean card data is encrypted at the reader and your network never sees it in the clear.
• Never store card numbers in spreadsheets, email, CRM notes or call recordings. If you take cards over the phone, use a virtual terminal and do not write the number down.
• Segment the systems that do touch card data from the rest of the office network.

Do those four things and most small businesses land on the shortest self-assessment questionnaire.

The questionnaire and the scan

Merchants below the largest volume tiers self-assess once a year against a questionnaire whose type depends on how cards are taken. Some types also require quarterly external vulnerability scans by an approved vendor. Your processor will tell you which applies. What version 4 added: a customized approach for organizations that want to meet requirements their own way, stronger authentication requirements, and targeted risk analysis for how often certain controls run.

The fee on your statement

Many processors charge a “PCI non-compliance fee” every month a questionnaire is not on file. It is often one of the fees we find on a statement that should not be there, because the questionnaire takes an afternoon. Some processors also use compliance language to pad fees in ways the standard does not require. We cut through that.

Beyond the checklist

PCI is a floor, not a security program. The controls that stop the attacks we actually see, phishing-resistant MFA and email authentication, are not payment-specific; see MFA that resists phishing. We implement PCI-aligned payment flows, prepare businesses for assessment, and design environments that minimize scope in the first place. That is on Security, and the framework itself, with the current version and link, is in the framework directory.