Selling goods on the internet is not quite as easy as it used to be. Up until only a few years ago, there were virtually no rules or regulations in place to protect online shoppers. Finally, in 2006, a global organisation introduced the Payment Card Industry Data Security Standard (PCI DSS). This set of continually evolving rules was designed to protect online credit card users.

How does it work? Every business that accepts credit or debit card payments on the internet must first obtain a merchant service account. These accounts are issued by banks and other reputable financial institutions. But since online selling is especially risky, banks require that every applicant and current account holder comply with PCI DSS. Let us take a moment to explain exactly what that entails.

At present, there are three basic validation tools that are used to help confirm PCI DSS compliance. The first and most common is the Self-Assessment Questionnaire (SAQ). Every company that applies for a merchant service account must complete an SAQ. The questionnaire was designed to ensure that a company is complying with PCI DSS. It is a simple test that can be completed within a matter of minutes.

Next, there is the PCI SSC vulnerability scan. This test is only required for companies that have an external facing IP address. What that means is that they store some of their customer's financial information on their servers. It also means that they are prime targets for hackers. As a result, these online businesses are required to complete a vulnerability scan four times a year.

The third and final validation tool is the Quality Security Assessor (QSA). The acronym can refer to either an individual or an organization whose job it is to ensure PCI DSS compliance. These experienced professionals are often hired by huge corporations to reduce the likelihood of future PCI DSS fines.