PCI DSS Guides in Plain English
21 guides in 3 topics
The standard is written for assessors. These guides are written for the person who owns the card terminal: what a term means, which part of the rule reaches a shop like yours, and what to ask the bank or the processor when the answer depends on them.
Quotes keep their quotation marks and name the document they come from. Where the Council or a vendor has not said something plainly, the guide says so rather than guessing.
SAQs, Levels & Scope
- What Is PCI Compliance?15 min
Who writes the rule, who enforces it, and what a shop owner actually does about it each year.
- How to Become PCI Compliant18 min
The yearly loop step by step: level, questionnaire, gaps, scans, and the attestation you send.
- PCI SAQ Types Explained20 min
One receipt per self-assessment questionnaire: who it fits and how it differs from the next.
- Tokenization vs Encryption17 min
Which of the two takes your systems out of PCI scope and which does not, told for a merchant.
- PCI DSS 4.0.1 Requirements for Small Merchants20 min
The twelve requirements in plain words, then what changed for small merchants under v4.0.1.
- What Is P2PE?17 min
A validated point-to-point encryption solution versus an encrypted reader, and why the list matters.
- Payment Tokenization16 min
What a payment token is, where it comes from, and what it changes about the card data you hold.
- PCI SAQ A18 min
The shortest questionnaire for online shops: who qualifies, and what the latest revision changed.
- PCI SAQ D17 min
The full questionnaire: why a merchant lands on it, and the setups that move you to a shorter one.
Guides9
Scans, Audits & Fees
- PCI Compliance Fees (and the Non-Compliance Fee)15 min
The PCI lines on your processing statement: who charges them, why, and how to stop the extra one.
- What Is a PCI ASV Scan?19 min
Which merchants need external scans, what a pass means, and what to do after a failed one.
- PCI Attestation of Compliance (AOC), ROC and QSAs Explained17 min
The paperwork names decoded: which one you send, which one you ask your vendors for, who signs.
- PCI Compliant Firewall Rules for Small Shops17 min
Network security controls in a one-router shop: keep the terminal apart and write the rules down.
- PCI Password and MFA Requirements19 min
What the standard asks of passwords and multi-factor sign-in, in plain words for a small team.
- PCI Security Awareness Training16 min
What the standard expects staff to learn, how often, and how a small shop can keep a record of it.
- PCI Penetration Testing Cost16 min
Which merchants need a penetration test, what drives its cost, and what to ask before you book one.
Guides7
Payments & Card Data
- Is Square PCI Compliant?16 min
What Square states it covers, and what a Square seller still has to validate and when.
- Is Stripe PCI Compliant?16 min
Stripe's own PCI status versus yours, and which way of using Stripe keeps your questionnaire short.
- How to Store Credit Card Information (PCI Rules)16 min
What you may keep, what you may never keep, and why your processor's token beats your own vault.
- Is QuickBooks PCI Compliant?16 min
QuickBooks Payments' stated PCI position, and what bookkeepers must never do with card numbers.
- Is Shopify PCI Compliant?16 min
What Shopify states about its own PCI status, and what a Shopify store owner still answers for.
Guides5