PCI Compliance for Small Business: Levels, SAQs and Costs

For most small businesses, PCI compliance means a yearly Self-Assessment Questionnaire (SAQ), not an outside audit. PCI DSS applies to every business that accepts payment cards, whatever its size (PCI SSC). Size changes how you prove it: the card brands sort merchants into levels, most small businesses land in the lowest one, and your acquiring bank tells you which SAQ to fill in.

This guide explains the PCI compliance levels, helps you pick your SAQ and walks through completing it. It also covers what drives the cost and how fines work. Everything here follows PCI DSS v4.0.1, the current version.

Download the PCI DSS Checklist

TL;DR

Does PCI DSS Apply to Small Businesses?

Yes. PCI DSS applies to every merchant that stores, processes or transmits cardholder data, or could affect its security, regardless of size or transaction volume. The card brands decide whether and how small merchants have to validate (PCI SSC).

The PCI Security Standards Council (PCI SSC) writes the standard but doesn't enforce it. The obligation comes from the card brands' rules, which reach you through the merchant agreement with your acquirer, the bank or processor that handles your card payments (PCI SSC FAQ 1212). Where a law asks for more, or conflicts with the standard, the law applies.

Outsourcing card handling shortens the work, though some always stays with you. If a payment provider handles every step, your SAQ is short, but you still complete it, keep a list of the service providers that touch card data and check their compliance status every year (Requirement 12.8).

PCI Compliance Levels: How Merchant Levels Work

PCI merchant levels are set by each card brand, not by PCI DSS, and they decide how you validate. Visa's levels (Visa):

Mastercard uses similar transaction bands with its own rules, and American Express, Discover and JCB run their own programs. Your acquirer decides how its program applies to you, so confirm your level with it in writing. For a small business, two points matter more than the level number:

• Level 4 rules vary. Visa's page recommends an SAQ and leaves the requirements to the acquirer, so two Level 4 merchants with different acquirers can have different obligations.
• Scans and penetration tests come from your SAQ, not your level. A Level 4 merchant on SAQ D runs the same quarterly ASV scans and yearly penetration tests as any other SAQ D merchant.

Which PCI SAQ Do You Need?

A PCI self-assessment questionnaire covers the parts of PCI DSS that apply to one payment setup. Each SAQ starts with eligibility criteria, and you can use it only if your business matches all of them. Your acquirer tells you which one to use (PCI SSC). The v4.0.1 SAQs were published in October 2024 and are free in the PCI SSC Document Library (Document Library).

Service providers that can self-assess use SAQ D for Service Providers, the only SAQ written for them. If you take payments more than one way, for example in a shop and online, ask your acquirer how to validate each channel.

SAQ A After the January 2025 Change

SAQ A is the shortest questionnaire and the one most small online stores aim for. On 30 January 2025, PCI SSC revised it. Requirements 6.4.3 and 11.6.1 on payment-page scripts, and the risk analysis behind 11.6.1, came out of SAQ A, and a new eligibility criterion went in: you confirm that your site is not susceptible to attacks from scripts that could affect your e-commerce system (PCI SSC).

A PCI SSC FAQ from February 2025 explains that the criterion applies when your page embeds the provider's payment form, for example in an iframe, and not when you redirect customers to the provider. You can confirm it by protecting your page against script attacks yourself, or with written confirmation from your PCI DSS compliant payment provider that its embedded form, set up as instructed, includes that protection (PCI SSC).

SAQ D: The Catch-All

Storing card data electronically, running your own payment software on an internet-connected network, or a mix of setups that no shorter SAQ covers will usually put you on SAQ D. It covers every applicable requirement, which is a lot for a small team. Before you start, ask whether a different payment setup would move you to a shorter SAQ. A hosted payment page or P2PE terminals can cost less than working through SAQ D's full scope every year.

How to Complete a PCI Self-Assessment Questionnaire

1. Ask your acquirer which SAQ it expects, when it is due and whether you need quarterly ASV scans. Get the answer in writing.
2. Map how card data moves through your business: terminals, website, phone orders, paper forms and the people who handle each. Anything that touches card data is in scope.
3. Shrink that map. Stop storing card numbers you don't need, shred old paper, and move payments to providers that keep card data off your systems.
4. Download the SAQ and the matching AOC from the PCI SSC Document Library. Read the eligibility criteria first; if one doesn't fit, you have the wrong SAQ.
5. Answer each requirement with evidence you could show if asked: policies, settings, scan reports, training records.
6. If your SAQ includes external scans (Requirement 11.3.2), have an Approved Scanning Vendor (ASV) scan every three months, and fix and rescan until each scan passes.
7. Sign the AOC and send it, with the SAQ and any scan reports, to your acquirer or through its portal.
8. Keep it running. Quarterly scans, terminal inspections and yearly training go in a calendar, and the evidence goes in one folder for next year.

Our PCI compliance checklist covers all 12 PCI DSS requirements in v4.0.1, so you can see what sits behind each SAQ question.

PCI DSS Basics for Small Merchants

PCI SSC's Guide to Safe Payments, written by its Small Merchant Task Force, lists 12 security basics, ordered from the easiest and cheapest to the hardest (Guide to Safe Payments). In our words:

1. Use strong passwords and change every default password, on terminals, routers and admin accounts.
2. Keep only the card data you need, and protect what you keep.
3. Check your payment terminals for tampering.
4. Work with trusted partners, and know how to reach them.
5. Install your vendors' security patches.
6. Limit who inside the business can get to card data.
7. Make remote access to your systems hard for attackers.
8. Run anti-virus software.
9. Scan for vulnerabilities and fix what you find.
10. Use secure payment terminals and solutions.
11. Protect your business from the internet, for example with a firewall.
12. Make stolen data useless, for example with P2PE or tokenization.

Each basic maps to one or more of the 12 PCI DSS requirements. The guide is free, and PCI SSC's merchant pages add plain-language guides to common payment systems and questions to ask your vendors.

Download the PCI DSS Checklist

PCI Compliance Cost for Small Business

There is no official price list for PCI compliance, and quotes vary widely. What you pay depends on a handful of drivers you can predict:

The less card data your own systems handle, the less PCI compliance costs. Before you buy a security product, check whether a change in how you take payments would move you to a shorter SAQ.

PCI Fines and Other Consequences

PCI SSC doesn't fine anyone. Fines and non-compliance fees come from the card brands, which apply them to acquirers under their rules, and your merchant agreement decides how they are passed on to you. PCI SSC publishes no fine amounts, and the figures quoted on vendor sites aren't official, so read your merchant agreement and ask your acquirer.

After a breach the stakes rise. PCI SSC's guide for small merchants lists financial penalties, lawsuits and the possible loss of the ability to accept cards (Guide to Safe Payments). Your merchant agreement is the document to read for what applies to you.

Common PCI Mistakes Small Businesses Make

• Picking the SAQ that looks shortest instead of the one whose eligibility criteria fit.
• Keeping card numbers where nobody looks: order spreadsheets, email, voicemail, photos on a staff phone, paper forms in a drawer.
• Assuming the payment provider covers everything. You still need its AOC and a written record of which requirements it manages and which you do (12.8.5).
• Leaving default passwords on terminals, routers and payment software.
• Never inspecting card terminals. Requirement 9.5.1 asks for a list of devices, periodic inspections for tampering and swapping, and staff who know what to look for.
• Treating the SAQ as a once-a-year form. Scans, inspections, patches and training run all year, and the evidence has to show it.
• Counting on laptop disk encryption to protect stored card numbers. Under Requirement 3.5.1.2, full-disk encryption on its own is acceptable only on removable media.
• Following guides that still list "firewall configuration" or "anti-virus software" as requirement names. They predate PCI DSS v4.

Where trio.so Fits

Small businesses often take payments on ordinary laptops, tablets and phones, and those devices are in scope when they touch card data or the systems around it. trio.so is device management software that enforces and reports their settings on Windows, Mac, iOS and Android from one console:

See how trio.so handles the device side of PCI DSS, area by area, with the evidence you can show your assessor.

• Encryption on the computers and phones you use for payments: BitLocker on Windows, FileVault on Mac with FileVault recovery key escrow, and encryption on iOS and Android phones, with the status of each device in one list. Disk encryption alone doesn't protect card numbers saved on a built-in drive (Requirement 3.5.1.2), so don't keep card numbers on these devices at all.
• Passcode and screen-lock policies for the staff phones and tablets that take payments or open your payment provider's dashboard.
• OS update management, so critical patches go on within the one-month window in Requirement 6.3.3.
• App allow and block lists, so a payment tablet runs only the apps you approved.
• A device inventory with installed apps, which covers the device part of the system list in Requirement 12.5.1.
• Lock for a lost Mac, iPhone or Android device, and wipe for company-owned devices.
• A compliance engine that checks device settings against framework device controls, PCI DSS among them, and evidence export you can file with your SAQ.

trio.so doesn't assess or validate PCI DSS compliance, and PCI SSC says no single product can make a business compliant (FAQ 1258). Your SAQ, signed and sent to your acquirer, does the validating. Terminal inspections, firewalls, ASV scans, MFA, anti-malware and your payment page need other tools, your payment provider or your own routines. Learn more about compliance automation.

Plans start at $5 per device.

Start free trial Book a demo

14-day free trial. No credit card required.

For other rules small companies face, see SMB compliance.

Sources. Last reviewed October 2026, against PCI DSS v4.0.1 (June 2024), the current version on 26 October 2026. This article is guidance, not legal or assessment advice; your acquirer, card brand and assessor have the final word. PCI DSS is © PCI Security Standards Council, LLC. Requirement numbers and titles are used for reference; descriptions are our own paraphrase. trio.so is not affiliated with or endorsed by PCI SSC.

• PCI SSC: Merchant resources
• PCI SSC FAQ 1212: who runs compliance validation
• Visa: Compliance validation, merchant and service provider levels
• PCI SSC: What's new with Self-Assessment Questionnaires in v4 (27 March 2024)
• PCI DSS v4.0.1 and SAQs, PCI SSC Document Library
• PCI SSC: Important updates for merchants validating to SAQ A (January 2025)
• PCI SSC: FAQ clarifies new SAQ A eligibility criteria (28 February 2025)
• PCI SSC: Data Security Essentials for Small Merchants, Guide to Safe Payments v3.0 (April 2024)
• PCI SSC listings: PTS devices, P2PE solutions, QSAs and ASVs
• PCI SSC FAQ 1258: no single product provides PCI DSS compliance