I was prompted recently to take a deeper look into some of the PCI requirement information, and I have found some pretty serious discrepancies with regard to the reporting obligations of Level 4 Merchants (less than 20,000 transactions per year).
Some suggest that Level 4 Merchants are not required to report on their PCI compliance (which does not mean that they aren't responsible for being compliant, only reporting on it annually) but others also suggests that Level 4 Merchants are required to annually scan their network in order to prove compliance. Also there are some websites that suggest Level 4 Merchants are required to undergo quarterly network scans, which is the same requirement for Level 3 Merchants:
I'm curious if anyone out there has any experience with this sort of thing. Again, I want to stress that ALL merchants that accept credit cards are obligated to maintain PCI compliance. However, the issue surrounds the reporting requirements for various merchants, as having scans and such is a service that a merchant will have to pay for.