The PCI Security Council is turning its attention more and more to smaller online businesses. Companies who are termed level 4 by the Council are only involved in processing less than 20,000 transactions per year. Yet these companies as whole represent the vast majority of online transactions for credit card payments. Many lack knowledge of the technology behind web hosting which often leaves them more vulnerable to security breaches than larger firms.

At present in order to show compliance to the PCI rules, small companies need to complete a Self-Assessment questionnaire and have their online card processing systems scanned once per quarter. But a payments processor may require a more strict level of scanning, possibly once a month.

Small online merchants who do not store credit card details but process payments through a third party such as PayPal need only fill in Version A of the Self-Assessment questionnaire. Since they represent no risk in terms of breach of security this should take minutes to fill in.

The other version of the questionnaire is more complicated and requires information about firewalls, scanners, encryption of data, and storage of data, anti-virus software, and security policies regarding personnel.

If any of the listed areas are currently not complied with then a date must be set for when they will be fulfilled.

As well as filling in and returning the questionnaires a small company must undergo a scan, which is free, by an ASV or approved Scanning Vendor. They will report on any issues which need fixing in order to achieve compliance. Re-testing may then take place around 2 weeks after the initial scan to check that the initiatives have been put in place.

If there a great number of things which need fixing it may be wise to enlist the help of a Qualified Security Assessor.