What is PCI DSS and does my small business need to comply?
Short answer
PCI DSS is the Payment Card Industry Data Security Standard, which applies to organizations that store, process or transmit payment card data. Most small merchants comply through their payment provider’s requirements, often with a self-assessment questionnaire, and reduce scope by never storing card data themselves.
The details
Using a hosted payment page or a reputable payment processor keeps card data off your systems and greatly simplifies compliance. Ask your provider which questionnaire applies to you.
Terms explained
- PCI DSS
- PCI DSS is the security standard for organizations that store, process or transmit payment card data, managed by the PCI Security Standards Council.
Sources
Related questions
Related Guides
GuideGRC
8 AI Vendor Risk Assessment Questions for Your Business
Review these 8 essential AI vendor risk assessment questions before adopting third-party artificial intelligence tools to protect your business data.
Read more GuideGRC
NIST AI RMF: Implementation Guide for Small Teams
Learn how small teams can implement the NIST AI RMF to assess risk, govern deployments, and deploy artificial intelligence safely without enterprise overhead.
Read more GuideGRC
How to Run a Vendor Security Assessment Before You Sign
Learn how to conduct a vendor security assessment before signing a contract. Follow these actionable steps to protect your data and reduce supply chain risk.
Read more GuideGRC
10 Steps to Implement ISO 27001 and Get Certified
A step-by-step ISO/IEC 27001:2022 implementation plan: scope, leadership, risk assessment, Statement of Applicability, Annex A controls, internal audit, management review and the certification audit.
Read more