PCI Compliance for Small Business: What You Actually Have to Do

Q: What does a small business need to do for PCI compliance?

Identify which self-assessment questionnaire matches how you accept cards, complete and sign it annually through your processor, keep payment systems on a segmented network separated from everything else, run quarterly external vulnerability scans if your questionnaire requires them, patch in-scope devices, control who can access the payment system, inspect terminals for tampering, and never store card numbers on paper or in email.

Q: Which PCI SAQ applies to my business?

It depends on processing method. Fully outsourced hosted payment pages use SAQ A. Standalone network-connected terminals use SAQ B-IP. Validated point-to-point encryption terminals use SAQ P2PE. Keying cards into a browser-based virtual terminal uses SAQ C-VT. Point-of-sale software on a PC uses SAQ C. Storing card data electronically or anything not covered elsewhere requires the full SAQ D, which is best avoided by changing methods.

Q: What happens if a small business is not PCI compliant?

The most common consequence is a monthly non-compliance fee added to your merchant processing statement, sometimes for years. After a breach, a non-compliant merchant can be liable for fraud losses, forensic investigation costs, and card brand fines, and can lose the ability to accept cards. A few hours of work each year typically removes the fee and the exposure.

PCI compliance for a small business means proving, once a year, that the way you accept credit cards meets the Payment Card Industry Data Security Standard, and for most small merchants that comes down to three things: filling out the correct self-assessment questionnaire, keeping card-handling systems separated from the rest of your network, and completing quarterly vulnerability scans if any of your systems touch card data over the internet. How much work that is depends almost entirely on how you take payments.

Who has to comply with PCI DSS?

Every business that accepts credit or debit cards, regardless of size or transaction count. The standard is a contractual requirement from the card brands enforced through your merchant processor, not a law, but the consequences of ignoring it are real: monthly non-compliance fees on your processing statement, liability for fraud losses after a breach, and in serious cases the loss of the ability to accept cards at all. The processor usually notifies you annually that your attestation is due, and many small businesses simply pay the fee for years without realizing that a few hours of work would remove it.

How does the way you take payments change your obligations?

PCI recognizes that a coffee shop with a countertop terminal is nothing like an online retailer with a shopping cart, so it offers several self-assessment questionnaires, or SAQs, matched to processing methods. Merchants below the transaction volumes that trigger a formal audit, which covers nearly every Treasure Coast small business, validate with an SAQ. The main ones:

SAQ A: All card processing is fully outsourced to a validated third party, such as a hosted payment page or a patient portal that never passes card numbers through your systems. Shortest questionnaire.
SAQ A-EP: Your website does not store card data but does influence the payment page, for example a redirect or embedded form you control. Substantially longer, because your web server is in scope.
SAQ B: Standalone dial-up terminals or imprint machines with no internet connection. Increasingly rare.
SAQ B-IP: Standalone terminals that connect over your network to the processor but do not send card data through any computer. Common in retail and restaurants.
SAQ P2PE: Terminals that are part of a validated point-to-point encryption solution. The card number is encrypted in the terminal and is unreadable on your network, which dramatically shrinks scope. Worth asking your processor about.
SAQ C-VT: Staff key card numbers into a virtual terminal in a browser on a dedicated computer. Common in medical, dental, and professional offices taking payments by phone.
SAQ C: A payment application on a computer connected to the internet, such as a point-of-sale system on a PC.
SAQ D: Everything else, including any merchant that stores card data electronically. This is the full standard and the one to avoid by changing how you process.

The practical lesson: you can often move to a shorter questionnaire by changing your processing method. A dental office that stops writing card numbers on intake forms and starts using a P2PE terminal and a hosted portal can go from SAQ D to SAQ A and P2PE, and the compliance work shrinks to a fraction.

What does network segmentation mean for a small office?

PCI applies its requirements to the cardholder data environment, which is every system that stores, processes, or transmits card data, plus anything connected to those systems without a barrier. If your payment terminal sits on the same flat network as the front desk computers, the guest Wi-Fi, and the smart TV, all of it is technically in scope. Segmentation puts a wall around the card systems so the rest of the office is not.

In practice this means a business-grade firewall and switches that support separate networks, a dedicated network for payment terminals and the virtual terminal computer, firewall rules that allow those devices to reach the processor and nothing else, and guest Wi-Fi that is completely isolated. It is the same work that good security practice already calls for, and it is a routine part of the network design we do for retail, medical, and hospitality clients.

What recurring tasks does PCI require?

Compliance is not a one-time project. Put these on the calendar.

Annual SAQ and attestation of compliance. Complete the questionnaire honestly, sign the attestation, and submit it through your processor's portal. Set a reminder for the same month each year.
Quarterly external vulnerability scans by an approved scanning vendor, required for SAQ A-EP, B-IP, C, D, and some others. The scan checks your public IP addresses for known weaknesses. A failed scan needs remediation and a rescan within the quarter.
Patching and updates on every in-scope device, including terminals and the firewall firmware.
Access reviews. Who can log into the payment system, with unique accounts and multi-factor authentication where the system supports it. Remove departed staff immediately.
Terminal inspections. Periodically check card readers for tampering or skimmers, and keep a list of device serial numbers and locations.
Policies and training. A short written policy on handling card data, and annual reminders to staff. In our experience the most common violation in professional offices is a card number written on a sticky note or saved in an email.
Log retention. Firewall and system logs for in-scope systems, kept for at least a year with three months readily available.

Do medical and dental offices have to worry about PCI?

Yes, and they are often surprised. A practice that takes copays at the front desk and payments over the phone is a card merchant like any other. The good news is that the same controls HIPAA expects, such as segmented networks, access control, and logging, overlap heavily with PCI. Tackling them together through a single compliance program is far more efficient than treating them as separate projects, and it produces one set of evidence for both.

How to make PCI compliance easy

Never store card numbers anywhere: not on paper, not in email, not in the practice management notes.
Use P2PE terminals and hosted payment pages to shrink scope.
Segment the network once, properly, and document it.
Schedule the scans and the annual attestation so they do not sneak up.
Have your IT provider complete the technical portions of the SAQ with you, because many questions are about firewall and system configuration that the office manager should not have to guess at.

If you are paying a non-compliance fee on your processing statement, or you are not sure which SAQ applies to you, MainSail Data will walk through it with you at no charge. We help retailers, restaurants, medical and dental practices, and professional offices across the Treasure Coast get and stay PCI compliant. Call (772) 794-1194 or request a compliance review.

PCI Compliance for Small Business: What You Actually Have to Do Compliance · 5 min read