IDENETY AI Intelligence Suite
Written by the engineers who built our real-check scanning tools
If your business accepts credit cards — in person, online, or over the phone — you are subject to the Payment Card Industry Data Security Standard (PCI-DSS). This applies to businesses of all sizes, from a single-location restaurant to a multi-location retail chain.
Non-compliance is expensive. Fines from card brands range from $5,000 to $100,000 per month. If you experience a data breach while non-compliant, you may be liable for the cost of fraudulent transactions, the cost of card replacement for affected cardholders, and forensic investigation costs — in addition to fines.
Here's what PCI-DSS actually requires, how compliance is assessed, and what it takes to achieve it.
Understanding PCI-DSS Levels
PCI-DSS compliance requirements vary based on your transaction volume:
Level 1: More than 6 million transactions per year. Requires an annual on-site assessment by a Qualified Security Assessor (QSA) and quarterly network scans.
Level 2: 1-6 million transactions per year. Requires an annual Self-Assessment Questionnaire (SAQ) and quarterly network scans.
Level 3: 20,000-1 million e-commerce transactions per year. Requires an annual SAQ and quarterly network scans.
Level 4: Fewer than 20,000 e-commerce transactions or up to 1 million other transactions per year. Requires an annual SAQ and may require quarterly network scans.
Most small businesses are Level 4. The SAQ is a self-assessment — you don't need a QSA — but you still need to actually implement the required controls.
The 12 PCI-DSS Requirements
PCI-DSS version 4.0 (the current version) has 12 high-level requirements:
1. Install and maintain network security controls. Firewalls between the cardholder data environment and untrusted networks. Documented network diagrams. Firewall rules reviewed every six months.
2. Apply secure configurations to all system components. No vendor default passwords. Documented configuration standards. Unnecessary services disabled.
3. Protect stored account data. Minimize cardholder data storage. Encrypt stored cardholder data. Protect encryption keys.
4. Protect cardholder data with strong cryptography during transmission. TLS 1.2 or higher for all transmission of cardholder data. No use of SSL or early TLS.
5. Protect all systems and networks from malicious software. Anti-malware on all systems. Regular scans. Malware protection that can't be disabled by users.
6. Develop and maintain secure systems and software. Patch management for all system components. Secure development practices for in-house applications. Web application firewall for public-facing web applications.
7. Restrict access to system components and cardholder data by business need to know. Role-based access control. Access limited to what's needed for job function.
8. Identify users and authenticate access to system components. Unique IDs for all users. Strong passwords or passphrases. MFA for all access to the cardholder data environment.
9. Restrict physical access to cardholder data. Physical access controls for systems that store, process, or transmit cardholder data. Visitor logs. Media destruction procedures.
10. Log and monitor all access to system components and cardholder data. Audit logging for all access to cardholder data. Log review procedures. Log retention for at least 12 months.
11. Test security of systems and networks regularly. Quarterly vulnerability scans by an Approved Scanning Vendor (ASV). Annual penetration testing. File integrity monitoring.
12. Support information security with organizational policies and programs. Information security policy. Security awareness training. Incident response plan. Third-party service provider management.
The Cardholder Data Environment
The most important concept in PCI-DSS is the cardholder data environment (CDE) — the systems, people, and processes that store, process, or transmit cardholder data, plus any systems that are connected to or could affect the security of those systems.
The smaller your CDE, the easier and cheaper compliance is. This is why scope reduction is the most important strategy in PCI-DSS compliance:
Use a payment processor that handles cardholder data. If you use a payment processor (Square, Stripe, Authorize.net) that handles cardholder data on their systems and you never see or store the actual card numbers, your CDE is much smaller.
Use point-to-point encryption (P2PE). P2PE solutions encrypt cardholder data at the point of swipe/dip/tap, before it enters your network. This can significantly reduce your CDE scope.
Segment your payment systems. Keep payment systems on a separate network segment from the rest of your business. This limits the scope of PCI-DSS requirements to the payment network.
Common PCI-DSS Compliance Gaps
Default passwords on payment terminals and network devices. This is one of the most common findings in PCI assessments and one of the easiest to fix.
No network segmentation. Payment systems on the same network as general business systems dramatically increases PCI scope and compliance costs.
Missing patches. Unpatched systems in the CDE are a common finding and a significant risk.
No log review. Audit logging is required, but many businesses enable logging without ever reviewing the logs.
Inadequate access controls. Shared accounts, excessive privileges, and no MFA are common findings.
Getting PCI Compliant
PCI-DSS compliance is achievable for businesses of any size, but it requires a systematic approach. Our team has helped dozens of San Antonio businesses achieve and maintain PCI compliance. Book a free assessment to see where your business stands and what it would take to get compliant.
Download this article as a PDF
Includes IDENETY Zone Intelligence branding · Shareable with your team
See how your network actually scores
Our AI Zone Intelligence Scanner checks your domain for the exact vulnerabilities covered in this article — in under 60 seconds. Free, no signup required.
Contact Us
Services
