PCI compliance, in plain English
If your business takes card payments, the card brands expect you to protect card data and confirm it once a year. Here's what that involves and where we help.
What PCI DSS is
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements for any business that accepts, processes, stores or transmits card data. It's maintained by the PCI Security Standards Council, which was founded by the major card brands.
Compliance has two parts: following the requirements every day, and validating each year that you do. Most small and mid-sized businesses validate with a self-assessment questionnaire rather than an outside audit.
How yearly validation works
- Step 1
Find your questionnaire
Your processor tells you which Self-Assessment Questionnaire (SAQ) matches how you take payments.
- Step 2
Answer the questions
The questionnaire asks how you handle card data, from the devices you use to who can access them.
- Step 3
Run scans if required
If your payment system connects to the internet in a way that's in scope, you may need quarterly scans by an Approved Scanning Vendor.
- Step 4
Submit and repeat yearly
Sign the attestation of compliance and submit it through your processor's PCI portal. Validation is renewed every year.
Which questionnaire applies?
The questionnaire depends on how you take payments. These are the common types. Your processor confirms yours.
- SAQ A
- Online or phone businesses that send all card data to a third-party payment page and never handle it themselves.
- SAQ B
- Businesses that use only imprint machines or standalone dial-out terminals, and store no card data electronically.
- SAQ B-IP
- Businesses that use only standalone, PCI-approved terminals connected to the processor over the internet.
- SAQ C-VT
- Businesses that key payments one at a time into a virtual terminal in a web browser.
- SAQ P2PE
- Businesses that use only a validated point-to-point encryption (P2PE) solution.
- SAQ D
- Everyone else, including businesses that store card data electronically.
Everyday habits that protect card data
Most of PCI DSS comes down to a few routines at the counter.
- Never write down or keep full card numbers, or the security code on the back of a card.
- Change the default passwords on terminals, routers and payment software.
- Install terminal software updates when they're offered.
- Check terminals regularly for tampering, such as extra parts attached or a loose card slot.
- Limit who can run refunds or change settings on your terminals.
- Keep payment devices off your guest Wi-Fi network.
How we help
[PLACEHOLDER: Describe TurnKey's PCI program: the portal merchants use to complete their questionnaire, who to contact for help, and any scanning provider]
[PLACEHOLDER: PCI program fee and any non-compliance fee, in plain terms]
Businesses in our veteran-owned program have the PCI fee waived. [PLACEHOLDER: Confirm this waiver is current] See the veteran-owned business program.
Stuck on your questionnaire?
Book a 15-minute call and we'll help you work out which questions apply to your setup.
Book a support callPCI questions
What is PCI compliance?
PCI DSS (the Payment Card Industry Data Security Standard) is a set of security requirements for any business that accepts, processes, stores or transmits card data. Being compliant means following those requirements and confirming it, usually once a year.
Does my business have to be PCI compliant?
Yes. Every business that accepts card payments is expected to comply, whatever its size. Smaller businesses usually confirm compliance with a self-assessment questionnaire rather than a full audit.
Does a new terminal make me compliant?
Not on its own. Using a current, PCI-approved terminal helps, and it can reduce what your questionnaire covers. You still need to complete your annual validation and follow good security habits.
What happens if I don't validate compliance?
Processors may charge a non-compliance fee until you validate, and a business that suffers a data breach while non-compliant can face fines and costs from the card networks. [PLACEHOLDER: Confirm whether TurnKey's processors charge a non-compliance fee, and how much]
Do you help with the questionnaire?
[PLACEHOLDER: Describe how TurnKey helps merchants complete PCI validation, for example a portal, a provider or a support contact]
Questions about compliance or fees?
Book a short call and we'll go through your PCI status and what your statement shows.
Prefer the phone? Call 1-888-365-8876