PCI-DSS (Payment Card Industry Data Security Standard) applies to any business that accepts, processes, stores, or transmits payment card data — which includes virtually every restaurant, retail store, and e-commerce merchant. The standard is not a government regulation; it is a contractual requirement imposed by the payment card brands (Visa, Mastercard, American Express, Discover) through their acquiring banks. Non-compliance exposes merchants to fines, higher interchange rates, and ultimately the loss of the ability to accept card payments. This guide explains what PCI compliance actually requires for a typical small restaurant or retail SMB and what your IT provider should be doing about it.
PCI-DSS Levels and SAQs: Where You Fit
Merchant compliance requirements are tiered by transaction volume. Most small restaurants and retail SMBs fall into Merchant Level 4 — fewer than 20,000 Visa e-commerce transactions per year or up to 1 million total Visa transactions per year. Level 4 merchants are required to complete an annual Self-Assessment Questionnaire (SAQ) and a quarterly network vulnerability scan; a full on-site audit by a Qualified Security Assessor (QSA) is not required at this level.
The SAQ is not a single document — there are multiple SAQ types depending on how you accept cards. The most common for small merchants:
SAQ A: For merchants who have outsourced all card data functions to a PCI-compliant third party and only accept card-not-present transactions (e-commerce). The simplest questionnaire — essentially validates that your third-party payment processor handles all card data and your systems never touch it.
SAQ B: For merchants using standalone dial-out or IP-connected POS terminals. Common for restaurants with a standalone terminal that connects directly to a payment processor without passing through the merchant's internal network.
SAQ B-IP: For merchants using standalone IP-connected POS terminals with an IP connection between the terminal and the payment processor, where the terminal is validated as a Payment Application Data Security Standard (PA-DSS) or P2PE solution.
SAQ C: For merchants with a payment application system connected to the internet. More complex — covers merchants using POS software installed on systems also connected to the internet.
SAQ D: The most comprehensive SAQ, applying to all merchants not covered by A, B, B-IP, or C. If your POS system stores cardholder data (card numbers, expiry dates), you're in SAQ D.
Determining which SAQ applies to your environment is the first step. Many merchants self-classify incorrectly — often into a simpler SAQ than their actual environment warrants. Your acquiring bank or payment processor can help determine the correct SAQ; so can a PCI-qualified IT professional.
The Scope Problem: Why PCI Is Harder Than It Sounds
The fundamental PCI compliance challenge for restaurants and retail SMBs is scope. The standard applies to all systems that store, process, or transmit cardholder data, and all systems connected to or that could affect those systems. For a restaurant with a POS system on the same network as a laptop, back-office PC, and guest WiFi, the scope may include all of those systems — even if the guest WiFi never touches payment data, if it's on the same network as the POS, it's in scope.
The most effective way to reduce PCI compliance scope is network segmentation: put all payment systems on a separate, isolated VLAN or physical network segment that has no connectivity to guest networks, office networks, or internet-connected systems outside the POS. A properly segmented POS environment can qualify for SAQ B or SAQ B-IP even in a relatively complex restaurant, dramatically reducing the compliance burden.
This is a specific IT architecture decision your MSP or IT provider should be making deliberately, not the default result of installing a POS system.
What PCI-DSS Requires of Your IT Infrastructure
The 12 PCI-DSS requirements (version 4.0, which became effective in 2024) translate to specific IT controls:
Network security: Install and maintain a network security solution (firewall). Specifically: no default vendor passwords on network devices, firewall rules documented and reviewed quarterly, remote access restricted and monitored.
Data protection: Protect stored cardholder data. No storage of the card's full magnetic stripe, card verification value (CVV), or PIN. If you store PANs (primary account numbers), they must be rendered unreadable through strong cryptography.
Vulnerability management: Protect systems against malware. Use antivirus/anti-malware on all systems "commonly affected by malicious software." Keep software patched — critical patches within one month.
Access control: Restrict access to cardholder data by business need. Unique user IDs for all users. Multi-factor authentication for all non-console administrative access and for all remote access into the cardholder data environment.
Monitoring: Log and monitor all access to system components and cardholder data. Maintain audit trails for at least one year (three months online).
Testing: Regularly test security systems. Quarterly vulnerability scans (internal and external) by an Approved Scanning Vendor (ASV) for merchants with internet-accessible systems.
Frequently Asked Questions
Does using Square, Toast, or another managed POS system exempt you from PCI?
Partially. If you use a payment service that handles all card data processing (the card is swiped on a hardware device owned and managed by the payment service, and cardholder data never touches your network), you may qualify for SAQ A or SAQ B, which are simpler. You are not entirely exempt — you still need to complete an SAQ, confirm the payment service is PCI-compliant, and maintain basic security hygiene on systems in your environment. Confirm with your acquiring bank.
What happens if you fail to comply with PCI-DSS and have a breach?
If a card data breach occurs and you are found to be non-compliant with PCI-DSS, card brands can assess fines of $5,000–$100,000 per month for non-compliance, plus breach-related assessments for card replacement costs. Your acquiring bank may terminate your ability to accept cards. The consequences are compounded: non-compliance before a breach means the breach is more expensive to resolve.
How often must PCI SAQs be renewed?
Annually. The self-assessment must be completed each year, and any required quarterly scans must be completed four times per year. Your acquiring bank tracks compliance status and may follow up if submissions lapse.
← HIPAA-Compliant IT Services | CMMC for Defense Contractors →