Skip to content
SwipeSeal
Menu

PCI DSS, made plain for small shops that take cards

Which questionnaire you file, when scans are due, and what to ask your payment vendors, for merchants who take cards at a counter, online or by phone.

Find your SAQ typeRead the guides
Dithered print of a card terminal with a receipt curling out and a chip card beside it
A countertop terminal, its receipt, and the tamper seal across its seam.

Free tools for the paperwork

All 11 tools

Answer plain questions about how you take cards and print what you need: your questionnaire, your level, your scope, a policy, a plan or a form. Nothing asks for a card number.

The loop a card-taking shop runs

The Council writes the standard; the card brands and your acquirer, the bank behind your card payments, decide when you prove it. The proof follows the same four steps every cycle, and the first one sets the size of the rest.

Every cycle

  1. 01Confirm your SAQ type with your acquirerSAQ type
  2. 02Complete every requirement on that SAQChecklist
  3. 03Pass an ASV scan every three months, where your SAQ includes itReq. 11.3.2
  4. 04Sign the Attestation of Compliance and send it to your acquirerAOC

Repeatson your acquirer's date

Four topics, one counter

Every page on the site sits under one of these. Start with the questionnaire if you are new to PCI; start with the vendors if a processor or a scan is already on your desk.

Vendors, compared on the rule

All 19 compares

Processors, gateways, phone-payment services, scanning vendors, consultants and compliance software, judged on what PCI DSS asks of them and of you: which questionnaire each leaves you with, and what you still have to do yourself. Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.

Guides to read first

What PCI compliance is, which questionnaire fits you, what an ASV scan checks, and what the fee on your statement is. Each guide quotes the Council or the vendor and says when it was read.

Guides

Guides21

Know your SAQ before your processor asks.

A few plain questions about your terminal, your checkout and your phone orders, walked to the questionnaire that fits each one, with the reasons quoted.

Find your SAQ typeAsk a question