PCI DSS (Payment Card Industry Data Security Standard)

PCI compliance verification happens annually (or quarterly for Level 1 merchants). You complete a Self-Assessment Questionnaire (SAQ) appropriate to your integration type: SAQ A for hosted payment pages (14 questions), SAQ A-EP for embedded iframes (182 questions), SAQ D for direct API integration (329 questions). The questionnaire asks detailed questions about security practices: do you maintain firewall configurations, encrypt cardholder data transmission, use strong passwords, restrict access to card data, maintain anti-virus software, test security systems quarterly, etc. You answer yes/no with supporting evidence. Additionally, you must pass quarterly vulnerability scans performed by Approved Scanning Vendors (ASVs) who probe your systems for security weaknesses. For Level 1 merchants, a Qualified Security Assessor conducts on-site audits: interviewing staff, reviewing systems, testing security controls, examining documentation. Once all requirements are met, you receive an Attestation of Compliance certificate valid for 12 months. Your PSP requires this certificate to maintain your merchant account - failing to provide it risks processing suspension.

PCI compliance isn't optional - it's a contractual requirement of your merchant agreement. Non-compliance risks immediate consequences: $5K-25K monthly fines from card networks (increasing to $100K for prolonged violations), merchant account termination (forcing you to find new processing, often at higher rates), and massive liability if data breaches occur. A merchant suffering a data breach while non-compliant faces the full cost of breach remediation: forensic investigation ($50K-200K), card reissuance for affected cardholders ($5-10 per card), fraud monitoring services for victims ($50-100 per person), legal fees, and potential class-action liability. Breaches affecting 10,000+ cards can cost $500K-2M+. PCI-compliant merchants have far lower breach liability - many costs shift to PSPs and insurance. Compliance also protects reputation. Customers increasingly expect secure checkout - publicized breaches destroy trust, reduce conversion rates, and damage brand value for years. High-risk merchants already face customer skepticism; demonstrating security through PCI compliance builds credibility.

Illustrative example — not a specific client engagement.

• A supplement merchant using direct API integration (SAQ-D) with $2M annual volume spent $8K annually on PCI compliance: vulnerability scans, documentation, security reviews. After switching to hosted payment pages (SAQ-A), compliance costs dropped to $1.2K annually - $6.8K savings while actually improving security and reducing breach liability.
• An online dating platform accidentally stored CVV codes in transaction logs (violating Requirement #3). During their annual PCI assessment, auditors discovered the violation. The merchant faced immediate non-compliance, $15K monthly fines until remediation, and was required to complete forensic security audit at $35K cost. Total impact: $65K+ before returning to compliance.
• A gaming operator suffered a breach affecting 15,000 cards while PCI-compliant. Because they met all requirements and used certified systems, their liability was limited to $50K forensic audit fees - the PSP and card networks absorbed $600K+ in card reissuance and fraud monitoring costs. A non-compliant merchant would have faced the entire $650K+ liability personally.

• Use hosted payment pages or embedded iframes to minimize PCI scope - qualify for SAQ-A instead of SAQ-D, reducing compliance costs by $15K-45K annually
• Implement tokenization for recurring billing - storing tokens not card numbers dramatically reduces breach liability and compliance burden
• Schedule quarterly vulnerability scans proactively - don't wait for reminders from your PSP, complete scans on fixed schedule
• Maintain detailed security documentation year-round - firewall configurations, access logs, system updates, security policies
• Never store CVV codes even temporarily - configure systems to immediately discard CVV after initial authorization
• Use strong, unique passwords for all payment systems - implement password managers and enforce minimum 12-character complexity
• For Level 1 merchants: engage QSAs 2-3 months before compliance deadline to identify and fix issues before formal audit

• Storing CVV codes even temporarily in logs or databases - this is explicitly prohibited and causes immediate PCI failure
• Using direct API card capture when hosted pages would work - increases PCI scope from SAQ-A (14 questions) to SAQ-D (329 questions) unnecessarily
• Transmitting card numbers over unencrypted connections (HTTP instead of HTTPS) - auto-fail PCI scans
• Failing to complete quarterly vulnerability scans - many merchants only remember PCI during annual renewal, missing quarterly requirements
• Using default passwords on payment systems and databases - Requirement #2 violation caught in every audit
• Not restricting access to cardholder data - giving all employees access instead of role-based permissions violates Requirement #7