PCI Compliance Information | START Merchant Services

Payment Card Industry Data Security Standard

What is PCI DSS Compliance?

PCI DSS (Payment Card Industry Data Security Standard) is a set of security requirements designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. Established by the major credit card brands (Visa, MasterCard, American Express, Discover, JCB), PCI compliance is mandatory for all merchants who accept payment cards.

Protects Customer Data

PCI DSS safeguards sensitive cardholder data including credit card numbers, expiration dates, and security codes. Compliance ensures this information is properly encrypted, stored securely, and protected from unauthorized access or data breaches.

Mandatory Requirement

All merchants who accept credit or debit cards must comply with PCI DSS regardless of size or transaction volume. Non-compliance can result in fines from $5,000 to $100,000 per month, increased transaction fees, and potential loss of card acceptance privileges.

Annual Validation

Merchants must validate their compliance annually through Self-Assessment Questionnaires (SAQs), quarterly network scans, and depending on transaction volume, may require on-site assessments by a Qualified Security Assessor (QSA).

Understanding Your Requirements

PCI Compliance Validation Levels

PCI compliance requirements vary based on your annual transaction volume. Understanding your validation level helps you determine which assessment procedures apply to your business.

Level 1: Over 6 Million Transactions Annually

Requirements: Annual Report on Compliance (ROC) by Qualified Security Assessor (QSA), quarterly network scans by Approved Scanning Vendor (ASV), and attestation of compliance. Most stringent validation level requiring on-site security assessment.

Level 2: 1 to 6 Million Transactions Annually

Requirements: Annual Self-Assessment Questionnaire (SAQ), quarterly network scans by ASV, and attestation of compliance. Some card brands may require annual ROC instead of SAQ at their discretion.

Level 3: 20,000 to 1 Million eCommerce Transactions Annually

Requirements: Annual SAQ, quarterly network scans by ASV, and attestation of compliance. This level applies specifically to eCommerce merchants with card-not-present transactions.

Level 4: Fewer than 20,000 eCommerce or 1 Million Total Transactions Annually

Requirements: Annual SAQ and quarterly network scans by ASV. This is the most common validation level for small to medium-sized merchants. While requirements are simpler, full compliance with all 12 PCI DSS requirements is still mandatory.

Core Security Requirements

The 12 Requirements of PCI DSS

All merchants must comply with these 12 fundamental security requirements designed to protect cardholder data and maintain a secure payment environment.

1. Install and Maintain Firewall Configuration: Protect cardholder data with properly configured firewalls and routers to prevent unauthorized access to your network and payment systems.
2. No Vendor-Supplied Defaults: Change all vendor-supplied default passwords and security parameters before deploying systems that handle cardholder data.
3. Protect Stored Cardholder Data: Minimize data storage and protect stored cardholder data using encryption, truncation, masking, and hashing where storage is necessary.
4. Encrypt Transmission of Cardholder Data: Use strong cryptography and security protocols (TLS, SSH, etc.) to protect cardholder data during transmission over open, public networks.
5. Protect Against Malware: Deploy and maintain anti-virus software on all systems commonly affected by malware, with regular updates and active scans.
6. Develop Secure Systems and Applications: Maintain secure systems and applications by applying security patches promptly and following secure development practices for custom code.
7. Restrict Access by Business Need-to-Know: Limit access to cardholder data to only those individuals whose jobs require such access through role-based access controls.
8. Identify and Authenticate Access: Assign a unique ID to each person with computer access and implement proper authentication through passwords or multi-factor authentication.
9. Restrict Physical Access to Cardholder Data: Protect physical access to systems and facilities that store, process, or transmit cardholder data using appropriate entry controls.
10. Track and Monitor Network Access: Log and monitor all access to network resources and cardholder data to detect and respond to security incidents quickly.
11. Regularly Test Security Systems: Test security systems and processes regularly through vulnerability scans, penetration testing, and review of security configurations.
12. Maintain Information Security Policy: Establish, publish, maintain, and disseminate a security policy that addresses information security for employees and contractors.

Simplified Compliance

How Authorize.Net Simplifies PCI Compliance

Using Authorize.Net as your payment gateway significantly reduces your PCI compliance burden by handling cardholder data on your behalf and providing built-in security features that help you meet PCI requirements.

Reduced SAQ Requirements: By using Authorize.Net's hosted payment forms or redirect methods, most merchants qualify for SAQ A (shortest questionnaire) instead of more complex SAQ D, reducing compliance requirements from 300+ questions to just 22.
PCI Level 1 Certified Gateway: Authorize.Net maintains PCI DSS Level 1 certification (the highest level), undergoes annual on-site audits, and handles billions of dollars in transactions securely. Your payment processing runs on a fully compliant infrastructure.
No Cardholder Data on Your Servers: Customer payment information never touches your servers when using proper Authorize.Net integration methods. Card data flows directly from customer to Authorize.Net, eliminating the most critical compliance requirements from your responsibility.
Built-In Fraud Prevention: Advanced Fraud Detection Suite (AFDS), Address Verification Service (AVS), Card Code Verification (CVV), and transaction velocity filters help you meet PCI requirement to protect against fraud and maintain secure payment processing.
Secure Data Storage with CIM: Customer Information Manager (CIM) securely stores payment profiles in Authorize.Net's PCI-compliant vault. You reference profiles by token, never storing actual card numbers, reducing your PCI scope dramatically.
Compliance Tools & Resources: Authorize.Net provides compliance documentation, SAQ completion guides, security best practices, and merchant compliance assistance to help you understand and meet your PCI obligations effectively.

Ready for Secure, Compliant Payment Processing?

Get started with a merchant account that includes PCI Level 1 certified Authorize.Net gateway. Simplified compliance, advanced fraud protection, and secure payment processing from day one.

Get Started Now Learn More About Compliance

Ready to Get Started?

Complete our quick and secure form. We'll review your inquiry and present the best solution within 24 business hours.

Most accounts approved in 1-5 business days

Secure & confidential

First Name *

Last Name *

Business Name *

Legal DBA or registered business name

Email Address *

Phone Number *

Preferred Contact Method *

Phone Call

Text Message

No Preference

Website / URL

Your business website or online presence

Subject

How Can We Help? *

By submitting this form, you agree to our Privacy Policy and consent to be contacted about our services. We respect your privacy and will never share your information.

Call Us

888-573-7587

M-F: 9:00 AM - 5:00 PM MST

Email Us

sales@startmerchantservices.com

Visit Us

1940 S. Fremont Dr STE 202
Salt Lake City, UT 84104

PCI DSS Compliance