{"id":4543,"date":"2016-04-04T10:47:33","date_gmt":"2016-04-04T15:47:33","guid":{"rendered":"https:\/\/content.findlaw-admin.com\/ability-law\/smallbusiness\/business-operations\/card-payment-security-pci-standards.html"},"modified":"2024-06-06T03:30:42","modified_gmt":"2024-06-06T08:30:42","slug":"card-payment-security-pci-standards","status":"publish","type":"page","link":"https:\/\/www.findlaw.com\/smallbusiness\/business-operations\/card-payment-security-pci-standards.html","title":{"rendered":"Payment Card Security: PCI Standards"},"content":{"rendered":"\n
\n \n
\n

Payment Card Security: PCI Standards<\/h1>\n
\n
\n By Susan Buckner, J.D.<\/a> | Legally reviewed by Aviana Cooper, Esq.<\/a>\n | Last updated\n
\n

Editorial Note: We earn a commission from affiliate partner links on FindLaw. Commissions do not affect the editorial integrity of our legal content.<\/p>\n\n <\/div>\n \n

\n \n <\/i>\n Legally Reviewed\n <\/summary>\n\n
\n

This article has been written and reviewed for legal accuracy, clarity, and style by FindLaw\u2019s team of legal writers and attorneys<\/a> and in accordance with our editorial standards<\/a>.<\/em><\/p>\n\n <\/div>\n <\/details>\n\n

\n \n <\/i>\n Fact-Checked\n <\/summary>\n\n
\n

The last updated date refers to the last time this article was reviewed by FindLaw or one of our contributing authors<\/a>. We make every effort to keep our articles updated. For information regarding a specific legal issue affecting you, please contact an attorney in your area<\/a>.<\/em><\/p>\n\n <\/div>\n <\/details>\n<\/section>\n

Businesses that use credit or debit card payments must follow the data protection standards created by the PCI Security Standards Council<\/a>. Major credit card companies established this organization to protect businesses, consumers, and banks from security breaches. All credit card companies and any business that accepts payments from them must follow payment card industry data security standards (PCI DSS).<\/p>\r\n

The major credit card companies (Visa, Mastercard, American Express, and Discover) want to avoid cardholder data breaches and loss of trust. Large and small businesses must follow these guidelines to transact with any signatory bank.<\/p>\r\n

The Federal Trade Commission (FTC) has not issued a formal mandate or regulation requiring PCI compliance. Compliance has the force of law based on convenience and legal precedent. A business does not have to be PCI compliant, but it will not be able to do business with credit cards, a necessity in e-commerce.<\/p>\r\n

Meeting PCI DSS Standards<\/h2>\r\n

Merchants handling payment cards should contact the PCI Security Standards Council <\/a>for a complete list of PCI DSS requirements. To ensure full compliance, there are 12 key requirements, 78 base requirements, and 400 test procedures. Small businesses can find compliance difficult, and PCI recommends hiring an auditor or PCI assessor to help with the process.<\/p>\r\n

There are four categories of PCI merchants. Business owners can determine their category by reviewing their credit card transactions and determining the number each company assigns to those transactions. For instance, Visa Level 4 merchants process fewer than 1 million total Visa transactions each year.<\/p>\r\n

Companies must complete a self-assessment questionnaire to meet the PCI data security standards. This determines which of the four categories the company falls into and what level of compliance is necessary.<\/p>\r\n

Three-Step Summary of PCI DSS Compliance<\/h3>\r\n

The 12 key requirements have three basic steps. This can make PCI compliance for small businesses easier than simultaneously trying to meet all 12 conditions. Reviewing your business data management systems with these three core concepts makes compliance easier.<\/p>\r\n