PCI Fundamentals for SMBs

If you’re a small business owner like me, you’re likely a jack-of-all-trades out of necessity, not out of actual interest. This can make annual PCI compliance requirements a stressful task, especially if you’re new to the PCI DSS. 

To make this easy, I talked with Marcus Clawson (Senior Product Manager at SecurityMetrics) and Jameson Olsen (Product Marketing Manager at SecurityMetrics) to see what SMB owners actually need to know about PCI to give you a simplified, four-step path to securing your small business.

The Stats: Small Businesses Are Under Attack

Make no mistake, just because your business isn’t dealing with the amount of revenue of, say, a Fortune 500 organization, does not mean you’re not a target for malicious threat actors. In fact, threat actors often target small businesses specifically because they’re typically easier to breach. 

Did you know that 43% of all cyberattacks target SMBs? SMBs are often targets because they lack the resources to protect themselves as larger, more established companies can. 

This poses a significant financial risk to a small business, with the average breach costing from a couple of thousand dollars up to hundreds of thousands of dollars. However, the highest cost is often customer trust. Olsen pointed out that “the loss of trust with customers if their data is leaked because you failed to protect it can have a huge impact on the reputation of your business." 

What is PCI DSS, and Why Does it Keep Changing?

PCI DSS is a security standard established by major card brands (e.g., Visa, Mastercard=) to standardize protections for cardholder data. Clawson explains that “all merchants that accept payment data or credit cards, payment cards need to comply with PCI."

Because the current threats drive the PCI standard, it needs to evolve (like the recent swap to version 4) to keep up with bad actors. These changes aren't meant to complicate your life.
In fact, Clawson says, "the Council looks at these requirements and realizes that they can be made more efficient... These changes are always evolving for the better. Better protection, more efficiency.” 

If you fail to protect your customers’ data, card companies can take action in the form of costly non-compliance fees or the card brands can even prevent you from processing their credit cards at all at your business.

The Four Steps to PCI Compliance for Your Small Business

PCI compliance doesn’t have to be a headache. The process can actually be broken down into four manageable steps.

Step 1: Identifying Your Scope (Finding Your SAQ)

The complexity of your compliance effort depends entirely on how you handle card data. The PCI Council uses Self-Assessment Questionnaires (SAQs) to group businesses into categories with applicable requirements. Clawson explains that an SAQ is "a way of grouping you into a category with a certain set of requirements, so you know what applies to you."

First, determine exactly what you do as an organization and how you handle card data (e.g., swiping at a kiosk, e-commerce, taking cards over the phone). Then, identify our SAQ type:

• SAQ A (Simplest): For businesses that fully outsource all card acceptance and processing to a third party. They are not handling or touching the card data in their own environment.
• SAQ C (Intermediate): For businesses using a virtual terminal, an IP terminal, or a point of sale system. The card data comes into their environment and requires protections.
• SAQ D (Most Complex): For service providers or large merchants handling significant amounts of cardholder data on behalf of other businesses. Marcus compares a complex environment to a home: "Just like your home, the more windows you have, the more you need to make sure that they're secure, closed, and locked."

See More: Which PCI SAQ Is Right For My Business? Blog

Step 2: Completing the Self-Assessment Questionnaire (SAQ)

Once your scope is defined, your provider will give you the appropriate questions and requirements for your business.

Keep in mind, the SAQ is a series of questions. Once you have met the requirements listed, you attest to that fact, then you receive a certificate that shows you are compliant for the year.

Step 3: Dealing with Additional Requirements (Tools and Testing)

Answering questions is only part of the process. Depending on your SAQ type, you will need to apply security tools and testing to validate your security posture:

• Vulnerability Scanning: Most businesses will need to use a tool to perform internal and external vulnerability scanning.
• Penetration Testing: Required for more complex scopes.
• Payment Page Tamper Monitoring: A significant requirement, especially for e-commerce, to prevent bad actors from inserting malicious scripts to steal data during a transaction.
• Network Components: Requirements often cover protections for network devices, including servers, switches, routers, and firewalls, because card data funnels through all these places to reach the bank.

Step 4: Reporting and Ongoing Maintenance

Once you've met all your requirements and attested to your compliance, you are issued a certificate of compliance. The next steps include:

• Reporting: Your compliance partner (like SecurityMetrics) will report your compliance directly to your merchant processor for you.
• Renewing and Managing: The partner will continue to send you account updates and will reach out when it is time to renew your PCI services, helping to take the mental energy out of management.
• Compliance is Annual: The SAQ and related requirements must be completed annually. If nothing has changed, the second year is much easier (yay!) 
• Routine Tasks: You must do things routinely (like scanning) to maintain compliance throughout the year. Check out this blog on how to remain PCI compliant year round. 

Choose the Best Support System

PCI compliance can be a big task for any small business owner. That’s why I like that SecurityMetrics is focused on making the experience simple while still protecting your business. 

When you choose a PCI compliance provider for your business, choose someone with 24/7, 365-day-a-year expert customer support. This will help you get the answers you need right away instead of spending hours on Google or Reddit trying to get niche answers to specific problems. 

You can also use free educational resources found on the SecurityMetrics blog and through the SecurityMetrics Academy. As Olsen reminds us, SecurityMetrics is “here to make sure that you can take care of the things you need to take care of on your cybersecurity front and get back to running your business."

Need a PCI partner who understands small business requirements? Speak to an expert today.