I have a small business, and I'm in the process of building a new website. My card processing company says I need to be PCI compliant. I know I did this once before years ago and had the Compliance Seal on my site, but now i'm getting sent in circles trying to get my site compliant.

Can someone please give me the steps to achieve compliance?


The PCI Security Standards Council has (defines!) all the steps to be compliant:

And many others including the Self Assessment Questionnaires that you must complete (and can use as a guide to seeing what you need to secure).


There are several ways to become PCI compliant. It all depends on how you are processing your transactions. If you are running a small business, avoidance might be the most cost-effective way as investments for PCI compliance can be signficant.

To avoid having to implement a PCI environment, you can opt to off-load your transaction processing to a third party like PayPal or another credit card processor. They provide several APIs and examples to ensure the PAN never touches your machines when processing a payment. Furthermore they often support a myriad of different cards compared to what you could do yourself.

  • Bingo. Far and away the simplest, easiest, and most secure way for a small web merchant to handle credit/debit card numbers while they are in its systems is to never have credit/debit card numbers in its systems to begin with. (Unless there's some special circumstance where that's just not a reasonable possibility. But, in general, better to save yourself the security risks & extra compliance headaches and just farm it out.) – mostlyinformed Oct 20 '15 at 2:55
  • You would still need SAQ A at a minimum, though this highly preferable to the alternatives! – Richard Nov 14 '15 at 1:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.