If your business accepts credit or debit cards, PCI compliance applies to you, whatever your size. The PCI Data Security Standard (PCI DSS) is meant for merchants of every size and transaction volume, and the card brands decide whether you must formally validate compliance. For most small businesses, validation means completing a Self-Assessment Questionnaire (SAQ) once a year and keeping your network and card-handling setup secure the rest of the time.
This guide explains which merchant level you probably fall into, what you have to file, what it typically costs, what happens if you ignore it, and which IT controls matter most. It also covers a question we hear from accounting firms: how PCI sits alongside client-data security and QuickBooks backups.
Key Takeaways
- PCI DSS applies to every business that accepts cards. Your processor and the card brands decide what proof of compliance you owe them.
- Most small businesses are Level 4 merchants and validate with an annual SAQ, sometimes plus quarterly network scans.
- Using an outsourced payment service reduces what you handle, but it does not remove your responsibility for the people, devices and network around it.
- Compliance is year-round work: patching, access control, training and tested backups, not a single form.
- Noncompliance can bring monthly fees, higher breach costs and, in the worst case, loss of the ability to accept cards.
Table of Contents
- Who needs to be PCI compliant?
- The four merchant levels and what each must file
- Can you do PCI compliance yourself?
- What the 12 requirements mean for a small office
- What PCI compliance costs
- What happens if you are not compliant
- Keeping PCI compliance going all year
- Accounting firms: PCI, client data and QuickBooks backups
- A practical PCI checklist for the next 30 days
- How Great Plains Networking helps
- FAQ
- Sources
Who needs to be PCI compliant?
Any business that stores, processes or transmits cardholder data. That covers a dental practice that takes copays at the front desk, a law firm that charges retainers by card, a nonprofit with an online donation page, and a manufacturer that takes card payments on invoices.
PCI DSS is not a federal law. It is a standard set by the PCI Security Standards Council and enforced through contracts between you, your payment processor and the card brands. The practical effect is similar: your merchant agreement requires you to comply, and the processor can charge fees or end the relationship if you do not.
The four merchant levels and what each must file
Card brands set validation levels by annual transaction volume, not by dollar amounts. Visa's small-merchant guidance (published November 2018) and Bank of America's merchant help page (February 2026) describe the same structure:
| Level | Annual volume (approximate) | Typical validation |
|---|---|---|
| 1 | More than 6 million card transactions, all channels | Annual Report on Compliance by a Qualified Security Assessor, plus Attestation of Compliance |
| 2 | 1 to 6 million transactions, all channels | SAQ and Attestation of Compliance |
| 3 | 20,000 to 1 million e-commerce transactions | SAQ and Attestation of Compliance |
| 4 | Fewer than 20,000 e-commerce transactions, or under 1 million overall | SAQ or other validation set by your acquirer |
Mastercard uses a similar structure. Its Site Data Protection program says Level 4 merchants must still comply with PCI DSS, even though Mastercard does not require them to validate to Mastercard directly, except where law or regulation says otherwise. Your own processor may still ask you for an annual attestation.
The practical point: a Level 4 merchant is not exempt. You are expected to meet the standard, and your processor decides how you prove it.
Can you do PCI compliance yourself?
Yes, for most small businesses. The PCI Council designed the Self-Assessment Questionnaire as a self-validation tool for small merchants who are not required to submit a full report on compliance. You answer questions about how you handle card data, fix what you cannot honestly answer "yes" to, and sign an attestation.
The form you use depends on how you take payments:
- Fully outsourced online checkout (a hosted payment page): the shortest questionnaire, SAQ A. The PCI Council has also published updates for merchants validating to SAQ A around the e-commerce requirements in PCI DSS v4.0.1, so use the current version.
- Card terminals or a point-of-sale system: a different SAQ, depending on whether the terminal is a validated, isolated device or connects to your network.
- Card numbers typed into your own computers or stored in your own files: the longest questionnaires, because your whole environment is in scope.
The hard part is rarely the form. It is knowing, truthfully, where card data goes in your business. A good first exercise is to walk through one card payment from the customer to the bank and write down every device, person, website and paper record it touches.
What changes if you use Square or another processor
Using a payment processor with its own hardware and software shrinks your scope, because the processor handles the sensitive data on its systems. It does not make you automatically compliant. You are still responsible for how your staff use the terminals, who has access, what is written down, which Wi-Fi the devices sit on and whether anything else captures card numbers (for example, an email with a card photo or a spreadsheet of payments).
The PCI Council's Guide to Safe Payments (April 2024) says that using a wholly outsourced third party to capture and process payments is often the safest option for a small merchant. It also lists the steps you still own: map your card data flows, stop storing cardholder data you do not need, keep terminal and network configurations secure, train employees and complete your annual self-assessment.
Processors publish their own guidance on what they take on and what they leave to you, such as Square's PCI compliance guide. Read your merchant agreement and your processor's portal to see which SAQ you are expected to complete.
What the 12 requirements mean for a small office
PCI DSS is organized into 12 requirements. For a small business, they reduce to a manageable list of everyday IT controls:
- Secure network. A properly configured firewall, no default passwords on routers or terminals, and card devices kept apart from guest Wi-Fi and general office traffic.
- Protect stored data. Do not keep full card numbers, and never the security code, after authorization. If you must store anything, it is encrypted.
- Vulnerability management. Current antivirus or endpoint protection, and security patches applied on schedule to every computer and device in scope.
- Access control. Unique logins for every person, access limited to those who need it, and multi-factor authentication (MFA) on remote and administrative access.
- Monitoring and testing. Logs that someone reviews, regular vulnerability scans, and a check that nothing has quietly changed.
- Policy and training. A written security policy, an incident response plan, and staff who know how to spot phishing and handle card data.
Notice how much of this is ordinary IT hygiene. That is why small businesses that keep their systems patched, monitored and documented find PCI far less painful than those fixing everything the week the questionnaire arrives. Our guide to network security basics for small business owners covers the firewall, segmentation and access pieces in plain language.
What PCI compliance costs
Costs vary with your level, your setup and who helps you. Published ranges from payment companies give a realistic picture:
- Stripe's November 2025 cost guide says small businesses typically spend $1,000 to $10,000 per year on SAQ completion, approved scanning services and keeping systems up to date.
- Square's June 2026 guide puts Level 4 at $60 to $75 per month and up, including scanning, SAQ completion and the attestation. It lists Level 3 at $1,200 a year and up, Level 2 at $10,000 a year and up, and Level 1 at $50,000 a year and up.
Treat these as ranges, not quotes. The biggest cost driver you control is scope. The fewer systems that touch card data, the smaller the questionnaire, the scan and the security work behind them.
What happens if you are not compliant
The consequences come through your processor, not a government agency. According to Payment Review's October 2026 analysis, Visa's guide for compromised merchants sets a non-compliance assessment for each breach where required incident-response steps are missed. For a Level 3 merchant it starts at $5,000, $10,000 or $25,000 depending on volume and can rise to $100,000, and for Level 1 and 2 merchants it is $100,000.
Processors also add their own charges. BAMS reports that noncompliance penalties can reach $100,000 per month, and that a breach without compliance documentation can bring fines between $500 and $500,000. Many processors also charge a monthly noncompliance fee until you file your attestation, and persistent failure can end with termination of your card-acceptance privileges.
A breach also costs you things no fee schedule covers: forensic investigation, customer notification, downtime and lost trust. For a dental practice or law firm, a breach involving client records can trigger separate obligations beyond PCI.
Keeping PCI compliance going all year
Filing the questionnaire once a year is the easy part. The PCI Council's guide describes compliance as an ongoing, year-round responsibility, not a one-time event. A simple annual rhythm works for most small offices:
| When | What to do |
|---|---|
| Every month | Review that patches installed on every computer, terminal and router; remove accounts for former staff |
| Every quarter | Run required external vulnerability scans if your processor asks for them; review firewall rules and who has admin access |
| Twice a year | Run phishing and card-handling refreshers for staff; check that terminals show no signs of tampering |
| Every year | Redo the card data flow map, complete the SAQ, update the incident response plan, test a data restore |
If you handle other regulated data as well, the same discipline carries over. Practices around data security and encryption matter wherever sensitive financial information is stored or sent, and staff awareness is part of every framework. Our security awareness training topics give a 90-day plan you can adapt.
Accounting firms: PCI, client data and QuickBooks backups
Accounting firms often land in two compliance worlds at once. If you take client payments by card, PCI applies to that process. Separately, firms preparing tax returns are treated as financial institutions under the FTC Safeguards Rule, which, as one checklist for CPA firms summarizes, means independent backups of client financial data encrypted at rest and in transit, MFA, a documented written information security plan and risk assessments, and restore tests at least annually. Check the requirements with the FTC or your compliance advisor for your own firm.
Card data and client ledgers are different risks, but the controls overlap: MFA, patching, encryption, restricted access and tested backups.
Backing up QuickBooks properly
If your firm or your clients run QuickBooks Desktop on a server or workstation, follow Intuit's own guidance:
- Create a backup of company files at the end of every session, keep the copy on a different device, and keep another copy away from the work location. Intuit also describes scheduled automatic backups with optional password encryption and attached-documents backup.
- To restore a backup, use File > Open or Restore Company, choose Restore a backup copy, then Local Backup, and browse to the .qbb file. If the backup sits on a USB drive or hosting service, move it to the local drive first, and do not restore into the folder holding the live company file, so you do not overwrite current data.
Then go one step further. Restore into a separate folder, open the file and check that balances, ledgers and recent transactions reconcile. A file that opens but does not reconcile is not a successful recovery. We lay out a repeatable process in our backup restore testing plan, and our business data backup best practices explain the 3-2-1 approach and why an offline or immutable copy matters against ransomware.
A practical PCI checklist for the next 30 days
- Find out your level and your SAQ. Ask your processor which questionnaire it expects and when it is due.
- Map your card data. Trace every place card numbers appear, including paper, email and shared drives.
- Remove what you do not need. Delete stored card numbers and stop accepting them by email or text.
- Separate and patch. Put payment devices on their own network segment, change default passwords and update firmware.
- Turn on MFA for email, remote access, your payment portal and administrator accounts.
- Train your staff on phishing and on how to handle a card over the phone.
- Write down your incident response plan: who to call, what to disconnect and how to reach your processor.
- Test a restore of your most important business data and record the result.
How Great Plains Networking helps
PCI is largely an IT discipline, and that is the part we run for small businesses in Norman, Moore and Oklahoma City. Our managed IT support includes 24/7 monitoring, same-day response and no long-term contracts. Our cybersecurity services cover ransomware and phishing protection, and our backup and recovery service handles backup and data recovery. We also provide compliance guidance for industries including dental and medical, law and accounting, and we explain it in plain language, without jargon.
Not sure where your gaps are? Start with our free 10-minute readiness audit, or ask for a free network assessment on our home page. You will see what is in place, what is missing and what to fix first.
FAQ
Do small businesses really need PCI compliance?
Yes. PCI DSS is intended for merchants of every size, and your agreement with your processor will require it. What you must submit depends on your merchant level, and for most small businesses that is an annual SAQ.
Can I do PCI compliance myself?
Often you can. The SAQ is a self-validation tool built for small merchants, and a hosted checkout or validated terminal keeps it short. If your setup is more complex, such as card numbers stored on your own systems, your IT provider can help you reduce scope and fix technical gaps before you sign.
Do I need to be PCI compliant if I use Square?
Yes, the standard still applies to you. Using an outsourced processor reduces the card data you handle, but you remain responsible for your staff, devices and network around it. Check your processor's portal for the exact questionnaire it expects.
How often do I have to validate compliance?
Annually for most merchants, and your processor may also ask for quarterly scans. The work behind it, such as patching, access reviews and training, should continue all year.
Sources
- Do small merchants with limited transaction volumes need to comply with PCI DSS?
- Visa: Review PCI Data Security Essentials for Small Merchants
- Bank of America: PCI Compliance Merchant Help
- Mastercard Site Data Protection Program and PCI
- PCI SSC: Completing a Self-Assessment
- PCI SSC: Important updates for merchants validating to SAQ A
- PCI SSC: Guide to Safe Payments
- Square: PCI Compliance guide
- Stripe: How much does PCI compliance cost?
- Payment Review: PCI compliance fees by processor
- BAMS: PCI compliance fees
- FTC Safeguards Rule checklist for CPA firms
- Intuit: Back up your company files
- Intuit: Restore a backup of your company file
- Tax Form Hero: Data security and encryption