PCI DSS — the Payment Card Industry Data Security Standard — applies to any business that accepts, processes, stores, or transmits card data. For a small shop that mostly means: don't be the weak link, and prove it once a year. This checklist runs in the order to do things, and every step names what it saves you. Do it once, then repeat the annual items on schedule.
The checklist: 9 steps in the order to do them
- Map how card data moves through your business. Counter terminal, online checkout, phone orders, paper slips — write down every path. You cannot protect (or shrink) what you haven't mapped.
- Shrink the target. Stop storing card numbers anywhere you don't have to: no spreadsheets, no paper slips in a drawer, no card numbers in email. Use tokenization or a compliant vault so the raw number never touches your systems.
- Confirm your providers are compliant. Collect current Attestations of Compliance from your processor, gateway, and POS vendor. Know which PCI requirements they handle and which are yours — write it down as a simple responsibility list.
- Figure out which SAQ is yours (see below) and complete it through your processor's portal. This single step is what stops the monthly non-compliance penalty.
- Lock down access. One login per employee, strong unique passwords, and remove access the day someone leaves. Change every vendor-default password on routers, terminals, and POS systems.
- Patch everything on schedule. POS software, terminals, and any computer touching payments get updates promptly — unpatched systems are how small breaches happen.
- Secure the network basics. A firewall between payments and everything else; encrypted Wi-Fi with a guest network that can't reach the terminal; antivirus where applicable.
- Run quarterly scans if you sell online. E-commerce merchants need an Approved Scanning Vendor (ASV) scan four times a year. Card-present-only businesses can usually skip this — confirm with your processor.
- Set the annual rhythm. SAQ once a year, scans quarterly if they apply, and a quick quarterly review of who has access and whether the firewall rules still make sense. Put it on the calendar or it won't happen.
What success looks like: a completed SAQ on file with your processor, no raw card numbers stored anywhere in the business, per-employee logins with ex-staff removed, and the non-compliance line gone from your statement within one to two billing cycles.
Which SAQ is yours (the step everyone stalls on)
The Self-Assessment Questionnaire comes in flavours, and picking the wrong one is why merchants stall. The short version:
| Your setup | Likely SAQ | Why |
|---|---|---|
| Online checkout fully outsourced (customers pay on the processor's hosted page) | SAQ A | Card data never touches your site — shortest questionnaire |
| Standalone IP-connected terminal, no electronic card storage | SAQ B-IP | Standalone PTS-approved device with IP connection to the processor |
| Point-to-point encrypted (P2PE) terminals | SAQ P2PE | Encryption is validated end-to-end by the solution provider |
| Integrated POS, or you store/transmit card data electronically | SAQ D (or C) | Broadest scope — the full questionnaire |
Ask your processor which one they expect — then verify the answer against your actual setup. Processors sometimes default merchants to the longest form.
What PCI DSS 4.0 changed for small merchants
Three 4.0 changes actually touch small shops: multi-factor authentication is now required for any administrative access into the cardholder-data environment — including from inside the office, not just remote logins. If you take payments through a web browser, you need a process to authorize and monitor the scripts running on your payment pages. And the old rhythm — scans, reviews, attestation — is now explicitly a continuous expectation, not an annual scramble.
The fee math: what the checklist saves
Doing nothing: the typical PCI non-compliance penalty runs $19.95–$49.95 per month — $240–$600 a year — and it sits on statements for years because nobody notices it. Small-business penalties are reported from $20/month up to $250/month depending on the processor.
Doing the checklist: the SAQ is completed through your processor's portal; an annual PCI program fee runs roughly $99–$200/year. Some processors charge $0 in PCI fees entirely.
The verdict: completing the SAQ converts a $240–$600/year penalty into a ~$100–$200/year program cost (or $0). The checklist pays for itself in the first quarter — before counting the breach risk it retires.
The penalty side is not theoretical. One merchant's experience, shared on Reddit and cited in industry coverage, describes an acquirer penalty that started at $5,000/month, escalated to $25,000, and reached the maximum tier at $100,000/month — the escalation pattern for prolonged non-compliance at volume. At small-business scale the numbers are smaller but the mechanism is identical: the fee appears quietly, monthly, until the SAQ is filed. Industry fee guides put the small-merchant non-compliance range at about $20–$50/month — small enough to ignore on a statement, large enough to exceed the cost of compliance within a year.
Note: this is a general-information checklist, not legal or security advice. PCI DSS is maintained by the PCI Security Standards Council; confirm your validation path with your processor or a Qualified Security Assessor if your setup is complex.
FAQ
Do I need PCI compliance if I only take cards in person?
Yes — any merchant that accepts cards must validate compliance. The good news: a card-present-only setup with modern encrypted terminals usually qualifies for the shortest SAQ and skips the quarterly scans.
Why am I being charged a PCI fee AND a non-compliance fee?
You shouldn't be paying both. The program fee covers the compliance service; the non-compliance penalty applies when the SAQ isn't completed. If both appear, complete the SAQ and dispute the penalty.
Does my processor handle PCI for me?
Partially. Processors secure their side and usually provide the SAQ portal, but your side — access control, passwords, patching, not storing card numbers — is yours. Get the responsibility split in writing.