The content of this article is provided for informational purposes only. You should always obtain independent business, tax, financial, and legal advice before making any business decision.
One of the biggest challenges facing small businesses is responsible, secure handling of customer data and payment transactions.
Proper handling is a business requirement, and if efforts fall short, you run the risk of exposing private information should your payment systems be breached by online criminals.
To help businesses reduce risks around data protection and security, the payments industry established the Payment Card Industry Security Standards Council (also known as PCI SSC or the PCI Council) and the Payment Card Industry Data Security Standard (PCI DSS).1
Here's what you need to know about PCI DSS compliance certification: what it is, who needs it, and how to get certified.
PCI DSS compliance is the process of adhering to certain security standards to protect customer information and mitigate the risk of fraud and data breaches. These PCI compliance standards help businesses safely handle credit card transactions and keep financial information secure.
PCI DSS certification goes one step further. It's the formal, documented proof that your business meets the Payment Card Industry Data Security Standard, validated through a Self-Assessment Questionnaire or an audit by a Qualified Security Assessor. Put simply, compliance is the ongoing state of meeting the standard, and certification is the evidence that you do.
The standard is governed by the PCI Security Standards Council, founded by the major card brands. It applies to every business that handles card payments, no matter how you take them.
Any business that stores, processes, or transmits cardholder data needs to be PCI compliant. That covers everyone from a solo online seller to a large enterprise, and it applies even when you use a third-party payment processor.
Knowing where card data lives in your systems is the first step, so it helps to map out how you handle and store financial data before you start the certification process.
Your certification path depends on your merchant level, which is set by how many card transactions you process each year. There are four levels, and each one determines how you validate compliance.
Level 1 applies to organizations that process more than 6 million Visa or Mastercard transactions2,3 in a 12-month period. It also includes merchants who have experienced a data breach. Level 1 merchants must complete an annual Report on Compliance (ROC) by a Qualified Security Assessor (QSA), a quarterly network scan by an Approved Scanning Vendor (ASV), and an Attestation of Compliance (AOC) form.2,3
Level 2 applies to organizations that process 1 to 6 million card transactions each year. 2,3 Requirements include an annual Self-Assessment Questionnaire (SAQ), a quarterly ASV network scan, and an AOC form.
Level 3 applies to merchants that process 20,000 to 1 million online transactions each year.2,3 The requirements match Level 2: an annual SAQ, a quarterly ASV scan, and an AOC form.
Level 4 applies to organizations that process fewer than 20,000 online transactions, or up to 1 million total transactions, each year.2,3 Validation requirements for Level 4 are set by the acquiring bank; Visa recommends an annual SAQ and a quarterly ASV scan where applicable.
American Express and Discover set their own merchant levels and thresholds, so check with your processor or the relevant card brand if you primarily accept those cards.4
Since its creation, the PCI Data Security Standard has gone through multiple iterations to keep up with the changing payment landscape. To find the most recent version, you can visit the PCI Security Standards Council website.5
The standard sets out 12 core requirements, grouped under six control objectives. You'll need to meet all of them to certify.
Requirement 1: Install and maintain a firewall configuration to protect cardholder data. Set firewall and router standards that control access to your systems, and review them regularly to catch faulty rules.
Requirement 2: Do not use vendor-supplied defaults for system passwords. Change default passwords and keep a secure inventory of all systems, passwords, and configuration procedures.
Requirement 3: Protect stored cardholder data. Store and encrypt all cardholder data using industry-accepted algorithms, and mask primary account numbers so only the first six or last four digits show.
Requirement 4: Encrypt transmission of cardholder data across open or public networks using protocols such as TLS and SSH. For more on protecting data in transit, see PayPal's tips on managing cyber fraud.
Requirement 5: Protect all systems against malware and regularly update anti-virus software on every workstation, laptop, and mobile device that accesses the system.
Requirement 6: Develop and maintain secure systems and applications by patching operating systems, firewalls, application software, databases, and POS terminals promptly.
Requirement 7: Restrict access to cardholder data on a need-to-know basis, keeping access permissions up to date.
Requirement 8: Assign a unique ID and password to each authorized user so access is accountable and traceable.
Requirement 9: Restrict physical access to cardholder data, storing any physical records in a secure, restricted location.
Requirement 10: Set up and maintain access logs, and audit them consistently to spot anomalies or threats.
Requirement 11: Conduct security and vulnerability tests frequently to find weaknesses, much like the steps you'd take to secure a website.
Requirement 12: Document policies and procedures covering all systems, software, and access logs involved in PCI DSS compliance.
Getting certified is a clear, repeatable process. Here's how to work through it.
Costs vary with your business size, transaction volume, and how much remediation you need. A Self-Assessment Questionnaire can cost little to a few thousand dollars, ASV scans typically run a few hundred to a few thousand dollars a year, and a full QSA audit for Level 1 merchants can reach tens of thousands. Timelines range from a few days to several weeks, depending on how ready your systems already are.
Requirements change over time, so confirm the current version and validation rules on the PCI Security Standards Council website before you begin.5
PCI DSS certification offers real advantages to any business that processes card transactions:
It also strengthens the everyday defenses that stop attacks before they start, from encryption to spotting phishing and spoofing attempts.
PayPal's payment tools can do the heavy lifting for you. When your customers enter their card details on PayPal's hosted, PCI-compliant checkout, sensitive data will not touches your servers, which can shrink your compliance scope and the work that comes with it.
Ready to help reduce your PCI burden? Accept payments with PayPal's online checkout or open a business account to get started, and explore Payflow gateway options for control over your checkout.