Myth 4: "I don't take enough credit cards..."

By John Kindervag

"…to need to be compliant." I have heard this statement from many clients. This is a common and broad misunderstanding of the requirements. While there are various levels of credit card merchant and service providers, there is no difference in compliance requirements. The fundamental confusion is between compliance and validation. PCI requires that any entity that stores, processes or transmits any credit card data to be in compliance with the PCI Data Security Standard. The amount of validation is the real differentiator.

Additionally, PCI assumes that each covered entity is always fully in compliance with PCI. I hear customers say that they must be compliant by such and such a date. That is wrong. What they need to understand is that they are assumed to be compliant right now, and there may be a date that they have to be validated as compliant. The fundamental difference between Level 1 and Level 4 PCI requirements is only regarding the amount of third-party validation that must be done to meet the certification process.

Any entity that takes credit cards takes enough credit cards to need to be compliant with PCI. The number of credit card transactions determines the level of validation, not compliance.

Five myths of PCI compliance

  Introduction to the myths of PCI compliance
  Myth 1: PCI is hard
  Myth 2: PCI will make us secure
  Myth 3: Encryption is scary
  Myth 4: "I don't take enough credit cards…"
  Myth 5: Product X will make me compliant