PCI DSS is the card industry’s security standard, and it applies to every business that takes cards — there is no “too small.” But here’s the merciful part most small stores never get told: how much of it lands on you is mostly decided by one architecture choice — whether card numbers ever touch your website.
The one choice that matters
If your checkout hands the card entry to your processor — a hosted payment page, or the processor’s embedded fields (Stripe Elements, PayPal’s hosted fields, and kin) — card numbers never touch your server. Your compliance burden drops to the shortest self-assessment forms (SAQ A or A-EP in the standard’s terms): a questionnaire’s worth of good hygiene, not an audit.
If your site collects card numbers itself and passes them along, your whole server is in scope — vulnerability scans, logging requirements, the long questionnaire, real ongoing cost. Almost no small store should be here, and most that are, are there by accident: an old integration built the heavy way because it was briefly fashionable.
If you don’t know which kind you have, that’s a fifteen-minute question for a developer, and it’s worth asking this week — it’s the difference between a checklist and a compliance project.
What’s still yours either way
Even with the light setup, the standard (version 4.0 became mandatory in 2024) expects the basics: a patched, maintained site, since a compromised page can be altered to skim cards as customers type no matter where the form submits; some attention to the scripts running on your checkout page — that’s what the newer 4.0 requirements target, because script-skimming is the attack that made Magento 1 famous; and the annual self-assessment your processor asks for. Ignoring that questionnaire ends with “non-compliance fees” on your statement — money for nothing.
The plain framing: PCI isn’t the threat. The threat is card skimming; PCI is the campsite checklist that keeps the food hung and the fire ringed. Keep card entry with your processor, keep the site patched, answer the annual questionnaire honestly — and this stays a small, boring line item. Boring is the goal.