Every company that accepts online credit or debit card payments must abide by PCI DSS. The actual acronym stands for Payment Card Industry Data Security Standard. This set of continually updated regulations was designed to protect online shoppers from internet thieves.

Because PCI standards are relatively new, there are a number of popular misconceptions that can get businesses into trouble. Probably the most common one is that smaller companies need not comply with PCI DSS. This misconception is based on the fact that there are different sets of rules that apply to businesses when it comes to internet selling. But the fact is that all companies must comply with PCI DSS.

Where to start? There are three basic tools that are used to validate PCI DSS compliance. The first and most popular one is the Self-Assessment Questionnaire (SAQ). There are several versions of this test depending on the size of the business and the number of monthly transactions. All internet sellers will be asked to complete the SAQ at least once a year to ensure PCI DSS compliance.

Next, there is the PCI SCC vulnerability scan. This scan must be completed four times a year by sellers that have an external facing IP address. This means that they store sensitive financial information on their servers. The scan, which must be completed by an Approved Scanning Vendor (ASV), will ensure that the company website is as secure.

Lastly, there are Quality Security Assessors (QSAs). These trained professionals are hired to guarantee PCI DSS compliance, often by larger companies. The truth is the service that they provide is quite expensive and most companies simply cannot afford it. But for those that can, a QSA virtually assures compliance. They will review the SAQ and the results of the scan and if everything is in order, the assessor will reward the company with a certificate of compliance. This certificate can then be submitted to the merchant service provider.