How to Become PCI Compliant: A Step-by-Step Guide for Small Businesses
If you are figuring out how to become pci compliant, the process comes down to a specific sequence of actions for your business. In order, those actions are:
| Step | Action | What You Do |
|---|---|---|
| 1 | Map Card Flow & Scope the CDE | Identify every system that touches card data and segment your network to shrink scope. |
| 2 | Choose Your SAQ | Pick the self-assessment questionnaire that matches how you accept payments. |
| 3 | Close Technical Gaps | Implement the 12 PCI DSS requirements that apply to your SAQ type. |
| 4 | Run ASV Scans | Pass quarterly external vulnerability scans through an Approved Scanning Vendor. |
| 5 | Attest & Submit | Complete the SAQ, sign the Attestation of Compliance, and submit to your acquirer. |
| 6 | Maintain Year-Round | Patch promptly, review logs, train employees, and re-check scope on every business change. |
PCI DSS stands for Payment Card Industry Data Security Standard. It is a strict set of security requirements created and maintained by the PCI Security Standards Council, which was founded by major card brands including Visa, Mastercard, American Express, Discover, and JCB. The standard exists to protect cardholder data from theft and fraud.
It applies to ANY business that accepts, processes, stores, or transmits payment card data, regardless of your company size or transaction volume.
While many owners assume this is a legal requirement, PCI compliance is not a government law in the US. It is a contractual obligation enforced by the card brands through your merchant agreement with your payment processor or acquiring bank. Failing to secure your environment carries severe consequences:
- Ignore the standard, and you can face recurring non-compliance fees on your merchant account, set by your acquiring bank or card brand.
- Suffer a card data breach while non-compliant, and the penalties escalate to a mandatory forensic investigation, card-brand assessments passed through your acquirer, card reissuance costs, and higher processing rates.
- At the extreme end, you can lose the ability to accept credit cards at all.
Step 1: Find How Card Data Flows and Define Your Scope
The first step in achieving compliance is understanding your PCI scope. You cannot protect what you cannot see, so you must identify your cardholder data environment. The cardholder data environment is the set of systems, people, and processes that store, process, or transmit cardholder data or sensitive authentication data, plus any system connected to them.
Cardholder data includes the primary account number, the cardholder name, the expiration date, and the service code. Sensitive authentication data includes the CVV security code, full magnetic-stripe data, and PINs.
You may NEVER store sensitive authentication data after authorization, even if it is encrypted.
If your business operates on a single, flat computer network, your entire office network is in scope for compliance. This makes meeting the security requirements incredibly difficult and expensive.
Network segmentation is the best way to solve this. By using firewalls to isolate your payment terminals and processing computers from your guest Wi-Fi and general employee workstations, you shrink the cardholder data environment. Shrinking this environment reduces the number of systems that have to meet the strict technical standards.
Step 2: Identify Your Merchant Level and SAQ
Once you know where your data lives, you must determine your reporting requirements. The card brands organize businesses into four pci compliance levels for merchants based on annual transaction volume. Under the commonly used Visa and Mastercard tiering, the levels break down like this:
| Merchant Level | Annual Transaction Volume | Typical Validation Path |
|---|---|---|
| Level 1 | Over 6 million transactions | On-site assessment by a Qualified Security Assessor, producing a formal Report on Compliance |
| Level 2 | 1 to 6 million transactions | Set by each card brand and your acquirer |
| Level 3 | 20,000 to 1 million e-commerce transactions | Set by each card brand and your acquirer |
| Level 4 | Fewer than 20,000 e-commerce transactions, or up to 1 million total transactions | Annual self-assessment questionnaire |
Exact thresholds and validation requirements are, in practice, set by each card brand and your acquirer, but most small businesses fall into Level 4. Most small and mid-size businesses validate their compliance annually by completing a self-assessment questionnaire pci document.
You must select the correct questionnaire based on how you take payments. If you are unsure, you can review the SAQ decision guide to find your match. Here is who each type is for:
| SAQ Type | Who it Is For |
|---|---|
| SAQ A | Card-not-present transactions where payment processing is fully outsourced to a validated third party like Stripe or Square |
| SAQ A-EP | E-commerce sites whose website affects the security of the payment page |
| SAQ B | Imprint machines or standalone dial-out terminals with no electronic storage |
| SAQ B-IP | Standalone IP-connected terminals |
| SAQ C | Payment application systems connected to the internet |
| SAQ C-VT | Manual entry via a virtual terminal |
| SAQ P2PE | Validated point-to-point encryption solutions |
| SAQ D | Everyone else. This is the longest form and is also the version used by service providers |
Step 3: Close the Technical Gaps
This step requires the most operational effort. You must review the PCI DSS requirements and upgrade your IT infrastructure to meet them.
The current version of the standard is PCI DSS 4.0.1, which superseded version 4.0. The older version 3.2.1 was retired on March 31, 2024, and the future-dated requirements introduced with PCI DSS 4.0 became mandatory on March 31, 2025.
The standard is organized into 12 requirements under six overarching goals. You must implement all of them that apply to your specific SAQ. Here is the map at a glance:
| Goal | Requirements & What They Cover |
|---|---|
| Build and Maintain a Secure Network and Systems | 1 & 2: Firewalls and network security controls; no vendor default passwords or settings. |
| Protect Account Data | 3 & 4: Encrypt stored account data; encrypt cardholder data during transmission over open networks. |
| Maintain a Vulnerability Management Program | 5 & 6: Anti-malware protection on all systems; install critical security patches promptly. |
| Implement Strong Access Control Measures | 7, 8 & 9: Need-to-know access only; unique user IDs and multi-factor authentication; physical security of terminals and processing areas. |
| Regularly Monitor and Test Networks | 10 & 11: Audit trails of all access to cardholder data; quarterly external scans and penetration testing. |
| Maintain an Information Security Policy | 12: Documented security practices that every employee understands and follows. |
Here is what each requirement asks of you in practice.
Build and Maintain a Secure Network and Systems
- Install and maintain network security controls and firewalls to protect cardholder data. You must filter traffic entering and leaving your payment environment.
- Apply secure configurations to all system components. You must never keep vendor defaults for system passwords or security parameters.
Protect Account Data
- Protect stored account data. If you must store the primary account number, it must be rendered unreadable through strong encryption or truncation. Again, you must never store sensitive authentication data like the CVV after authorization.
- Protect cardholder data with strong cryptography during transmission over open public networks.
Maintain a Vulnerability Management Program
- Protect all systems and networks against malware. You must deploy and actively update antivirus software on all systems commonly affected by malicious software.
- Develop and maintain secure systems and software. This requires installing critical security patches promptly to protect against known vulnerabilities.
Implement Strong Access Control Measures
- Restrict access to system components and cardholder data by business need-to-know. Employees should only have access to the data required to do their specific jobs.
- Identify users and authenticate access to system components. Every user must have a unique ID. You must also implement multi-factor authentication for all access into the cardholder data environment.
- Restrict physical access to cardholder data. You must secure physical payment terminals from tampering and control visitor access to areas where data is processed.
Regularly Monitor and Test Networks
- Log and monitor all access to system components and cardholder data. You need audit trails to track who accessed what and when.
- Test security of systems and networks regularly. This includes running quarterly external scans and performing penetration testing to find security gaps before attackers do.
Maintain an Information Security Policy
- Maintain an information security policy and program. You must document your security practices and ensure all employees understand their responsibilities.
Step 4: Run Required ASV Scans
Depending on your merchant profile and the specific questionnaire you must complete, you may be required to run quarterly external vulnerability scans. These scans cannot be run by just any it tool. They must be performed by an Approved Scanning Vendor, an organization validated by the PCI Security Standards Council to perform these specific network checks.
The vendor will scan your public-facing IP addresses and web applications to identify known weaknesses. If the scan reveals failing vulnerabilities, the remediation loop looks like this:
- Patch the software the scan flagged.
- Fix the configuration errors.
- Rescan the environment until you achieve a passing result.
You must maintain passing scans every quarter to remain compliant.
Step 5: Complete and Attest the SAQ
Once your technical controls are fully implemented and your external scans are passing, you are ready to formalize your compliance. You will fill out your designated self-assessment questionnaire, answering “Yes”, “No”, or “Not Applicable” to each technical control.
After completing the questionnaire, an authorized officer of your company must sign the Attestation of Compliance. You then submit the completed questionnaire, the signed attestation, and your passing scan reports to your acquiring bank or payment processor.
Many business owners search for a formal pci compliance certification to display. For Level 4 merchants — where most small businesses fall — this signed Attestation of Compliance IS the official deliverable. There is no separate certificate issued by the PCI Security Standards Council.
Only Level 1 merchants, who process over 6 million transactions annually, receive a formal Report on Compliance prepared by a Qualified Security Assessor. When your acquirer or a partner asks for proof, your completed SAQ, signed attestation, and passing scan reports serve as your compliance evidence.
Step 6: Keep it Current Year-Round
Achieving compliance is not a one-time project that you can forget about until next year. The standard requires continuous operational discipline. You must actively maintain your firewalls, apply security patches as soon as vendors release them, review your access logs, and train new employees on security policies.
If you change your payment processing methods, add new software to your network, or move to a new office, your scope may change. You must evaluate these business changes to ensure your cardholder data environment remains secure and segmented.
Your PCI Compliance Steps Checklist
Before you file anything, work through this recap of the six steps:
- Map where card data flows, define your cardholder data environment, and segment your network to shrink scope.
- Identify your merchant level and select the SAQ that matches how you take payments.
- Close the technical gaps across the 12 PCI DSS requirements that apply to your SAQ.
- Run quarterly external scans through an Approved Scanning Vendor and remediate until they pass.
- Complete your SAQ and have an authorized officer sign the Attestation of Compliance.
- Keep it current all year: patch promptly, review access logs, train employees, and re-check your scope whenever the business changes.
See Where You Stand
Free 2-minute PCI self-check: 8 plain-English questions, your risk level and the exact gaps to fix. No sign-up to see your result. free PCI compliance checklist
DIY vs With an IT Partner
PCI compliance for small businesses can be overwhelming if you do not have a dedicated internal IT department. The table below breaks down what each compliance task demands when you handle it alone versus when an experienced IT partner carries the technical load.
| Compliance Task | DIY Burden | With an IT Partner |
|---|---|---|
| Scope mapping | You must identify every system touching card data and segment the network yourself. Mistakes here expand your compliance burden. | Partner maps the cardholder data environment and builds proper network segmentation so only the right systems fall in scope. |
| Firewall configuration | You configure and maintain firewall rules to filter traffic entering and leaving the payment environment. | Partner deploys and manages firewalls, keeps rules current, and monitors for configuration drift. |
| MFA deployment | You roll out multi-factor authentication across all systems that access cardholder data and enforce unique user IDs. | Partner implements MFA across your environment, enforces password policies, and manages user access controls. |
| Security patching | You track vendor patch releases, test them, and deploy critical patches before attackers exploit known vulnerabilities. | Partner monitors patch releases, tests compatibility, and deploys patches on a disciplined schedule. |
| Audit log configuration | You configure logging on every in-scope system, review logs for unusual activity, and retain records. | Partner sets up centralized logging, configures alert thresholds, and maintains audit trails. |
| ASV scan remediation | You interpret scan findings, research fixes for each failing vulnerability, and rescan until you pass. | Partner triages scan results, applies the technical fixes, and manages the remediation-rescan cycle. |
| Attestation signing | You sign as the authorized officer. If your foundation is not solid, you carry the liability. | Partner cannot sign on your behalf. They ensure every technical control is met so you sign with confidence. |
Related Guides
- What Is PCI Compliance? A Plain-English Guide
- Which PCI SAQ Do I Need? A 2-Minute Decision Guide
- What Is the Cardholder Data Environment (CDE)? PCI Scope
- The 12 PCI DSS Requirements Explained in Plain English
Frequently Asked Questions
Can I do PCI compliance myself?
Yes, if you are a Level 4 merchant, you are allowed to complete the self-assessment questionnaire yourself without hiring a formal auditor. However, implementing the mandatory technical controls like network segmentation, firewall configuration, and multi-factor authentication usually requires professional it expertise to do correctly.
Is PCI compliance required by law?
PCI compliance is not a government law in the United States. It is a strict contractual obligation enforced by the major credit card brands through your acquiring bank or payment processor. Failing to comply results in financial penalties and increased liability during a data breach.
How much does it cost to become PCI compliant?
The cost varies entirely based on your business size, transaction volume, and the current state of your IT infrastructure. Small businesses with simple, well-maintained networks generally spend the least, mainly on required scanning vendor fees and minor it upgrades, while larger organizations may spend thousands on network overhauls and professional security audits.
Can I become PCI compliant for free?
The self-assessment questionnaire itself is free to download and complete. The unavoidable costs are the quarterly external scans from an Approved Scanning Vendor and any it upgrades your network needs to meet the security requirements.
To keep costs as low as possible, take the shortest path: use a validated P2PE terminal solution (SAQ P2PE, the briefest questionnaire) or fully outsource payment processing to a PCI-validated provider (SAQ A). Both approaches dramatically reduce how many technical controls apply to you, which means fewer systems to upgrade and fewer scan targets.
How long does it take to become PCI compliant?
If your network is already highly secure and well-documented, completing the questionnaire and running the required scans can take just a few days. If you need to upgrade firewalls, implement multi-factor authentication, or segment a flat network, the remediation process can take several weeks or months.
Can I get a PCI compliance certificate?
For most small businesses (Level 4 merchants), the signed Attestation of Compliance IS your official deliverable — there is no separate certificate issued by the PCI Security Standards Council.
Only Level 1 merchants, who process over 6 million transactions annually, receive a formal Report on Compliance prepared by a Qualified Security Assessor. When your acquirer or a business partner asks for proof of compliance, you submit your completed SAQ, signed attestation, and passing ASV scan reports. That package is your compliance evidence.
Secure Your Payment Environment
LeadingIT is a Chicagoland managed it and cybersecurity provider that has helped Illinois businesses since 2010. We serve roughly 200 organizations and over 2,500 users from our offices in Woodstock and Manteno.
We help you become and stay compliant by operating the technical half of PCI:
- Network segmentation to shrink your cardholder data environment
- Multi-factor authentication deployment across all in-scope systems
- Security patching on a disciplined schedule
- Audit log configuration and monitoring
- ASV scan remediation until you achieve a passing result
While we are not a QSA or ASV, we provide LeadingIT’s PCI compliance services (done-for-you path) to ensure your network meets the standard. If you need help securing your environment, contact us or book a call today.
