PCI Compliance for Small Businesses: How Acquirers Help

Think your business is too small to be a target? This episode explains how AI changed PCI compliance risk for small businesses, and how acquirers help merchants stay protected.

Jen Stone
Principal Security Analyst
MCIS, CISSP, CISA, QSA
Updated:  
November 10, 2026

How Acquirers Help Small Businesses With PCI Compliance: Lisa Jackson of Elavon

Practical Cybersecurity Podcast

Host: Jen Stone, Principal Security Analyst, SecurityMetrics Guest: Lisa Jackson, PCI Governance, Elavon (a subsidiary of U.S. Bank)

Episode summary

Lisa Jackson leads PCI governance at Elavon, where she supports both Elavon's own PCI assessments and the PCI compliance of its merchants, from level 1 enterprises to level 3 and level 4 small businesses. In this episode, she talks with SecurityMetrics' Jen Stone about why she became an Internal Security Assessor (ISA), how an acquirer helps small and mid-sized businesses (SMBs) work through their Self-Assessment Questionnaires (SAQs), and how AI-driven attacks are changing risk for merchants who think they're too small to be targeted.

Key takeaways

  • Acquirers share PCI responsibility with their merchants. Lisa explains that part of her role is clarifying which PCI DSS requirements Elavon covers as the acquirer and which the merchant owns, using the responsibility matrix.
  • The ISA credential helps compliance teams push back on assessors. Lisa became an ISA so she could confidently challenge a QSA's interpretation of a requirement and explain how Elavon meets it.
  • Explaining the "why" makes SAQs less daunting. Lisa finds that level 3 and level 4 merchants engage with PCI once someone walks them through what the questions mean and what their actual responsibility is.
  • AI has removed the "too small to target" safety net. According to Lisa, attackers now use bots to target thousands of small businesses at once.
  • For many small businesses, business risk is personal risk. Owners' personal information is often tied to the business, so a breach can expose their home, family, and credit details.
  • PCI works best framed as "you should," not just "you have to." Lisa's goal is to remove the stigma of PCI by showing merchants how it protects them.

Full transcript of PCI Compliance for Small Businesses: How Acquirers Help

Who is Lisa Jackson, and what does PCI governance at Elavon involve?

Jen Stone: Lisa Jackson, thank you so much for joining me today. There are a lot of people who know who you are. You're very well known in this industry, and you have a wealth of knowledge from the years that you've spent helping develop it. But for the people who are unfamiliar with you, would you please let everyone know what your background and what it is that you do?

Lisa Jackson: Thank you for having me. I appreciate the opportunity. My name is Lisa Jackson. I actually do PCI governance for Elavon, which is a subsidiary of U.S. Bank. Most people have heard our names. I've been in this industry working for the bank for about 19 years. I started on the technology side, worked my way into compliance, kind of shoved. I guess it came out of necessity for a need for where we are. And it's evolved. And I've made it my mission to make PCI no longer be a dirty four-letter word.

Jen Stone: That is a monumental task. So tell me a little bit about the work that you have done for PCI at Elavon.

Lisa Jackson: So for me right now, doing PCI governance for Elavon, I have a couple of pieces that I do. So I work and support our internal assessments, all the way from our DSS assessments to our P2PE, PIN, all of that, anything new that comes down the pipeline. But I also support our SMB and our level three and four merchants with their PCI compliance, as well as our level ones and twos. So I have both ends of the coin. I support our merchants in their compliance, and I help Elavon in and of itself to be compliant.

Why would an acquirer's PCI lead become an Internal Security Assessor (ISA)?

Jen Stone: And as I understand it, you're an ISA as well. Lisa Jackson: I am. Jen Stone: That is a huge thing. Can you tell people who aren't quite sure about the ISA, whether that's right for them? Can you talk a little bit about how it supports you?

Lisa Jackson: So one of my big reasons actually came out of a conversation that I had with a QSA, and I didn't agree with what the QSA said that we had to do. Like, you have to do this. And I'm like, okay, I'm reading the requirement just like you are. And he was taking it as his interpretation. And because I wasn't a QSA and I wasn't an ISA, I didn't feel as comfortable pushing back. Jen Stone: Sure. Lisa Jackson: But as the acquirer, it's my responsibility to make sure that I'm pushing back where we need to. And so it's not just making sure that Elavon is compliant and that our customers are, but the changes, because PCI does change with the industry. Making sure I have a good enough understanding so that if we do get a QSA that says, hey, you should do X, Y, Z, I can say, well, no, we actually meet the requirement this way, through what we're doing. Especially with the changes that they're doing with the compensating controls and some of the things that they're looking to do now. I think that's going to become more and more important for people such as myself to be able to understand and explain that.

Jen Stone: Right. And for sure, with the new customized approach as well. Because I think what you're saying is there's a lot of very good ways to meet the intent of PCI. What is it we're trying to, like, get that security in there? And some things work better for one organization that might not work as well for another organization. So amazing that you decided to take on that ISA training and testing and become that role so that you could be an advocate within your organization.

Lisa Jackson: And I don't do the actual assessments for Elavon. It was truly about being able to advocate for us and for our customers. Because if you think about most small to midsize merchants, they don't have QSAs. They don't have technical people. They don't understand. And even some of our level ones and twos, some of the questions we get from some of our verticals, they come and they're saying, hey, our QSA is asking this. And I have to be able to explain to them, well, no, this is the part that is covered by us as your acquirer. This is your responsibility in this. So making sure that they understand the responsibility matrix and what's going on. Because sometimes I get included in conversations with their QSAs. Sometimes it's them just saying, hey, we got this question, we have no idea what we're supposed to say. So it's being able to advocate for Elavon, making sure we're doing everything that we need to do, we're the best representation for our customers, but also providing that support. Because I know our customers, not all of them can have ISAs. Not all of them want to have. A lot of them, from a PCI perspective, do still think of PCI as a dirty four-letter word. So trying to destigmatize that, make sure that it is, okay, I can do this, I understand, I've got Elavon, got my back. And I know that if I have a problem, I can go to Lisa and her team, and they'll help me understand, and they'll help me get what I need to do.

How does Elavon help level 3 and level 4 merchants with PCI compliance?

Jen Stone: And that's, I think, tremendous support that you offer. The level threes and level fours that you're talking about, how do you help them with their journey? Because as you said, it's so big and so terrifying, getting told all of a sudden now you have to meet PCI compliance. And some of them have never even heard of it before. So what kind of things do you do to support your small and medium businesses?

Lisa Jackson: So we work with VC, and we have a PCI portal, which helps our merchants go through and validate their SAQs. Where my team comes in is, well, I own the relationship with VC. I own PCI governance for Elavon. So my responsibility for the threes and fours is not just to make sure that they're completing their SAQs, but being there to answer their questions. What I've found is that with a lot of threes and fours, once you explain it to them and help them to understand why they need to do that, they're like, okay, I get it. Right. I get it, because it's very daunting. You look at an SAQ and it's like, oh my gosh, that's 40 pages. Jen Stone: Yes. Lisa Jackson: How do I do that? I don't even know what some of these questions mean. And being able to say, all right, just relax. Here we are. Let's talk through it. This part is stuff that we do for you. This is what that means for you. It's being able to educate our customers at all levels so that they understand what truly is their responsibility and what their risk is, making sure that they're protected. And they do have a lot of dependency, because we're not just their acquirer for a lot of these, we're their processor as well. So they depend on us to be that expert and to know those things. So as long as I can help them know and help them understand and let them know that we got their back. My whole job is to make sure that they maintain their compliance, and making sure they understand why they need to do that.

How is AI changing cybersecurity risk for small businesses?

Jen Stone: And I'm certain that providing that context and the explanation of why is just so critical to their success. So I'm really happy to hear that that is something that is offered to them. It is a struggle with the changes. Sometimes groups will say, why are we changing? Why are we always changing? And I try to explain to them that we are directly responding to the additional threats in the bigger universe. Sometimes PCI has to adapt to the changes and the threats that we're seeing. But I know that, especially for SMBs, how do you help them navigate that change?

Lisa Jackson: One of the big pieces that we're looking at doing now is helping them focus on their cybersecurity. The big threat now, and I think everybody is aware of this, is AI. And if you look at who the biggest attack vectors are, these small-sized businesses, because they do not have those controls in place. They don't understand. They don't know that they need to have those, because they think, I'm not that big. Nobody's going to want to come after me.

Jen Stone: That's the way we used to think about it. And there was a lot of truth in that. But AI changed all that. Lisa Jackson: Yes. AI has made it so now it's not one person going after one location. It's one person with a thousand bots going after 10,000 locations. Jen Stone: Right. Lisa Jackson: So you may be small merchant X, and you think, okay, well, I don't have that. But you now are one of 10,000 that are under attack by the same bot that has gone after all these different pieces. And it can be very scary, with what you're talking about. And how do these SMBs, they shouldn't be expected to know what's the best cybersecurity software. How do I protect myself? How do I make sure my payments don't get done? Because a lot of them don't understand, if that bot gets your information, what the downstream impact can be. And a lot of these SMBs, when they start their business, their own personal information is tied to their business. So it's not just their business that becomes at risk, it's their personal. Somebody can get information about their home. They can get information about their children, their credit history, their credit cards, all these things, because it's so closely tied to their business. And if they're not thinking about, how do I secure that, and how do I make sure I'm protected when I'm taking payments? Because that's a gateway for a lot of this stuff. So it's helping them understand, helping them not be fearful of it. Jen Stone: Yes. Lisa Jackson: Because it can be very overwhelming. Even coming in as an acquirer and a processor, if you start to look at all the different vectors and all the different areas that there can be threats, it can be overwhelming. It gets overwhelming sometimes for us when we look at it and go, okay, how do we stop it? And we have to make sure that we're controlling the risk. And honestly, with some of our small and mid-sized merchants, it's actually a little easier, because the way they're attacked is going to be a lot more direct than for some of the larger merchants that we support. Those larger merchants already have their own IT shops. They have all of those things. So it's a little easier for us to say, hey, you, small to mid-sized merchant, we got you. This is what you need to do. This is how we're working to help protect you, and to make sure you, your family, your business, everything is protected.

Why should PCI compliance lead with empathy instead of fear?

Jen Stone: Well, and you're absolutely right. This can feel overwhelming and frightening. But what I hear from you is that you're not just hammering away about the threats. You're not just, you know, you have to be compliant. But you are leading with knowledge and experience and empathy.

Lisa Jackson: Yes. If you think about it, Elavon is obviously not my first job. I've worked for businesses from small to large. So if you think about if you're a small business today, thinking about how you take payments is, okay, I can do this. This is simple. I don't have to worry about anything else associated with it. And if you started ten years ago, that truly was the case. It was, okay, I set up my terminal, I do this. This is how it’s processed. That's all I got to worry about. Well, the landscape has changed so much. And if you look at the generations, I mean, I'm in one of those older generations, so I remember some of that stuff. But it's very hard for some of the generations, even some in my generation, to understand and be able to fathom what that looks like. So it's overwhelming. And then you have these small businesses that have been in business for 20-plus years, and now they're being told, I got to do all of this. And they're like, I never had to do this before, I don't understand. So trying to take away not just the stigma, but the overwhelming feeling of it. Helping them to understand that PCI isn't just a you have to do it. It's a you should do it. Here's why. And this is how it protects you with what you're doing. Here's the offerings. And this is how we can make sure that you, your business, and everything is safe.

Jen Stone: Thank you so much for coming and talking to me about this. I think it helps to have a little insight into how an organization, an acquirer especially, really does support SMBs as they work towards their own PCI journey. I appreciate your time.

Lisa Jackson: No problem. Thank you. We love our SMBs, so I'm happy to be able to talk and share some of the stuff that we're doing, and I look forward to seeing how this turned out. Jen Stone: Thank you, I appreciate it.

Frequently asked questions

What does an acquirer do for PCI compliance?

An acquirer is the bank or financial institution that processes card payments on behalf of a merchant. In this episode, Lisa Jackson explains that Elavon, as an acquirer and processor, covers part of the PCI DSS responsibility for its merchants and helps them understand which requirements are theirs to meet.

What is the difference between an ISA and a QSA?

A Qualified Security Assessor (QSA) is an independent assessor certified by the PCI Security Standards Council to perform PCI DSS assessments. An Internal Security Assessor (ISA) is an employee trained by the PCI SSC to support their own organization's compliance. Lisa became an ISA so she could advocate for Elavon and its customers when a QSA's interpretation of a requirement differed from hers.

How can small businesses get help completing a PCI SAQ?

Small merchants can start by asking their acquirer or payment processor what support is available. Lisa describes how Elavon uses a PCI portal through VC for SAQ validation, and how her team answers merchants' questions and explains what each part of the SAQ means for them.

Why are small businesses being targeted by cyberattacks?

Lisa explains that AI lets a single attacker run bots against thousands of locations at once, so small businesses without strong controls are now frequent targets, even if they believe they're too small to be noticed.

Glossary

  • PCI DSS: The Payment Card Industry Data Security Standard, the security requirements for organizations that store, process, or transmit payment card data.
  • Acquirer: The bank or financial institution that processes card payments on behalf of a merchant.
  • Processor: The company that handles the technical processing of card transactions.
  • Merchant levels: Card brands classify merchants by annual transaction volume. Level 1 merchants are the largest; level 3 and level 4 merchants are typically small and mid-sized businesses.
  • SAQ (Self-Assessment Questionnaire): The tool eligible merchants use to validate their PCI DSS compliance.
  • QSA (Qualified Security Assessor): An independent assessor certified by the PCI SSC to perform PCI DSS assessments.
  • ISA (Internal Security Assessor): An employee trained and qualified by the PCI SSC to support their own organization's PCI compliance.
  • P2PE (Point-to-Point Encryption): A PCI SSC standard for encrypting card data from the point of interaction.
  • PIN: The PCI PIN Security requirements, which cover the protection of PIN data.
  • Compensating controls: Alternative controls an organization can use when it can't meet a PCI DSS requirement as written due to a legitimate constraint.
  • Customized approach: An option introduced in PCI DSS v4.0 that lets organizations meet a requirement's stated objective with controls that differ from the defined approach.
  • Responsibility matrix: A document that defines which PCI DSS requirements are managed by which party, such as the merchant or its service provider.