All companies running websites which take payments from customers via credit card must ensure that they are hosting them in line with the security standards set down by the Payments Cards Industry. Companies that fail to do so run the risk of fines, restrictions or expulsion from the scheme.

Compliance is measured by assessment, initially by being scanned by an ASV or approved Scanning Vendor, approved by the PCI Security Council. The Vulnerability Scan covers everything which has been touched by an outward facing IP address regarding the acceptance, transmission and storage of sensitive credit card information.

The length of time taken to achieve compliance depends on the percentage of perceived security threats thrown up by the scan. The more threats the scan reveals then the longer it will take to fix them and achieve PCI compliance. Also there is a difference in the number of PCI protocols which different types of merchants must adhere to.

The Security Council assigns levels to e-merchants: A level one company processes more than six million transactions per annum. A company may also be given a level one rating if it has suffered from compromised data in the past. This level of company will have to comply with the strictest measures in order to attain PCI compliance.

A level two company processes between 150,000 and six million transactions a year and will have fewer PCI compliance regulations to comply with, A level three company will process between 20,000 and 150,000 transactions per year and a level four will be a small e-commerce site processing fewer than 20,000 card transactions.

The amount of time taken by e-commerce businesses varies according to the time it takes to fill in a self-assessment questionnaire, the amount of protocols which require compliance and the amount of manpower at their disposal to resolve compliance issues. This can be anything from days to weeks.