If you take card payments, you’re subject to PCI DSS. Most small business owners know the acronym and almost nothing else, which is roughly where the anxiety comes from.
Here’s the plain version.
It’s not a certificate you buy
PCI DSS is a set of security requirements from the card brands. It’s enforced through your merchant agreement, not by a government body. Nobody issues you a badge. For most small merchants, compliance means completing a self-assessment questionnaire annually and being able to back up your answers.
The consequences of ignoring it are real but indirect: monthly non-compliance fees from your processor, and — if a breach traces back to you — liability that is not capped at anything comfortable.
The parts that actually involve your network
Most of the questionnaire is process and policy. The parts we get called about are these:
- Segmentation. Anything that touches card data should be isolated from everything else. Guest Wi-Fi on the same network as your terminals is the single most common failure we find.
- Default passwords. Every switch, router, and access point shipped with one. Changing them is one of the earliest requirements in the standard, and it’s still routinely skipped.
- Patching. Systems in scope need to be kept current. This is where unmanaged environments quietly fall out of compliance over a couple of years.
- Access control. Individual logins, not a shared password everyone knows. Removal when staff leave.
- Logging. Being able to show who did what, and when.
What reduces your scope
The cheapest compliance is having less in scope. Point-to-point encryption on your terminals, so card data is never in the clear on your network, dramatically narrows what the questionnaire covers. Ask your payment processor whether your terminals support it — many merchants already have it and don’t know.
Segmenting properly does the same thing: it takes your back-office computers and your guest network out of scope entirely.
Where people get caught out
Two patterns come up repeatedly. The first is assuming the POS vendor handles it — they handle their application, not your network. The second is answering the questionnaire optimistically. It’s a formal attestation. Answering yes to a control you don’t have is worse than answering honestly and fixing it.
A reasonable first step
Pull up your last self-assessment questionnaire and read the network questions. If you can’t answer them from memory, that’s the gap. Documenting what you actually have is the prerequisite for everything else — which is why our Groundwork audit includes a segmentation review.