%20(500%20x%20100%20px)%20(1)-BAu4ZwEH.png)
Security & Compliance
PCI Compliance for Small Businesses, Explained
A complete walkthrough of PCI DSS for merchants under 1 million transactions per year — what to do, which form to fill out, and how to never pay a non-compliance fee again.
12
PCI requirements
4
Merchant levels
$0
Cost with PaySmart
$100k
Max non-compliance fine
The 12 PCI DSS Requirements
Grouped into six control objectives. Most small businesses satisfy them automatically through their POS and processor.
Install and maintain a firewall
Block unauthorized network traffic in and out of any system that handles card data.
Do not use vendor-supplied defaults
Change every default password and remove default accounts on routers, terminals, and servers.
Protect stored cardholder data
Encrypt or tokenize PANs at rest. Truncate them on receipts. Better yet — never store them.
Encrypt transmission across public networks
Use TLS 1.2+ on every link that carries cardholder data outside your network.
Use and update anti-malware
Install antivirus on every system that could be exposed to malicious software.
Develop and maintain secure systems
Patch systems within 30 days of vendor release; follow secure coding for any custom software.
Restrict access to cardholder data
Apply role-based access — only employees who need card data for their job can see it.
Identify and authenticate access
Unique user IDs, strong passwords, and multi-factor authentication for any non-console access.
Restrict physical access
Lock up paper receipts, devices, and any media containing cardholder data.
Track and monitor all access
Audit logs for every system that touches card data, retained for at least one year.
Regularly test security systems
Quarterly external vulnerability scans and annual penetration testing where applicable.
Maintain an information security policy
A written policy reviewed annually, plus security awareness training for staff.
Pick the Right SAQ for Your Business
| SAQ Type | Who It's For | # Questions |
|---|---|---|
| SAQ A | E-commerce using fully outsourced/hosted payment page | 22 |
| SAQ A-EP | E-commerce site that controls the checkout but sends card to processor | 191 |
| SAQ B | Standalone dial-up or IP terminals, no electronic storage | 41 |
| SAQ B-IP | Standalone IP-connected terminal | 82 |
| SAQ C-VT | Web-based virtual terminal on dedicated computer | 79 |
| SAQ C | POS system connected to the internet | 160 |
| SAQ P2PE | Point-to-point encrypted terminals from validated PCI P2PE solutions | 33 |
| SAQ D | Anything that doesn't fit the above | 329 |
Why PaySmart Includes PCI Compliance Free
Free guided SAQ completion — usually 15 minutes
No PCI non-compliance fees, ever
Quarterly external vulnerability scans included
Free P2PE-validated terminals shrink your scope dramatically
Tokenization on every gateway transaction
24/7 US-based compliance support
Frequently Asked Questions
Stop Paying PCI Non-Compliance Fees
PaySmart includes PCI compliance free on every account. Switch and we'll guide you through your SAQ in under 15 minutes.
Get Compliant for Free