PCI DSS Compliance for Ecommerce Merchants: A Plain Guide

This guide provides general technical information. It is not legal, medical, tax or financial advice. Confirm requirements with a qualified adviser for your jurisdiction and implementation.

What PCI DSS is

The Payment Card Industry Data Security Standard is a set of security requirements created by the major card brands. It applies to any organization that stores, processes or transmits cardholder data. Compliance is enforced through your acquiring bank or payment provider rather than by a government regulator, although a breach can also trigger legal and regulatory consequences.

Version 4.0 of the standard became the active version, with additional requirements phased in. Check the PCI Security Standards Council for the current requirements and timelines.

Your checkout design determines your scope

The less card data touches your systems, the fewer requirements apply. Common ecommerce integration types:

Most merchants should use a hosted or tokenized approach and never store card numbers. Platforms like Shopify handle checkout themselves, which narrows what you must do, though you still have obligations.

Self-assessment questionnaires

Smaller merchants usually complete a Self-Assessment Questionnaire matching their setup. For example, merchants fully redirecting or fully outsourcing payment pages typically use shorter forms, while those whose own pages deliver payment fields have additional requirements. Your acquirer or payment provider tells you which applies and what validation they require. Larger volumes may require a formal assessment.

The twelve requirement areas in brief

The standard groups its requirements into areas such as:

• Network security controls such as firewalls.
• Secure configuration, with no vendor default passwords.
• Protecting stored account data.
• Encrypting transmissions over open networks.
• Protection against malware.
• Secure systems and software, including timely patching.
• Access restricted by business need to know.
• Identification and authentication, with multifactor authentication.
• Physical access restrictions.
• Logging and monitoring.
• Regular security testing, including vulnerability scans.
• Policies and organizational responsibility.

How many apply to you depends on scope.

Payment page scripts matter

Attackers often target the checkout page by injecting malicious JavaScript that steals card details as customers type, an attack commonly called web skimming. PCI DSS 4.0 added requirements for managing scripts on payment pages, including keeping an inventory of scripts, justifying each one and detecting unauthorized changes. Practical steps:

• Remove unnecessary third-party scripts, tags and apps from checkout.
• Keep an inventory with owners and reasons.
• Use content security policy and subresource integrity where feasible.
• Monitor for changes to scripts on payment pages.
• Limit who can edit templates or tag managers.

Practical steps for a small merchant

• Confirm how your payment flow is built, and ask your provider for your required SAQ type.
• Use a hosted or tokenized checkout.
• Never store or email card numbers, and train staff on this.
• Keep your platform, plugins and server software updated.
• Use strong, unique passwords and multifactor authentication for admin accounts.
• Restrict admin access and remove unused accounts.
• Run required vulnerability scans through an approved provider if requested.
• Maintain a security policy and an incident response plan.
• Review your compliance annually, and when you change platforms or add payment methods.

What happens in a breach

If you suspect a compromise, contact your payment provider and acquirer promptly, preserve logs, contain the issue and follow breach notification laws, which differ by state and province. Having a written incident response plan before it happens saves valuable time.

Compliance is not just paperwork

Validation proves you met a standard at a point in time. Security is the ongoing practice behind it. Treat PCI as a baseline and keep up routine patching, monitoring and access control.

FAQ

Do I need PCI compliance if I use Shopify or Stripe?

Yes, you still have responsibilities, but using a compliant hosted checkout reduces your scope. Confirm what applies with your provider.

What happens if I’m not compliant?

Your acquirer can charge fees, restrict your account or, after a breach, assess penalties and costs. Non-compliance also increases the risk of a damaging incident.

Which SAQ do I fill in?

It depends on how you take payments. Your payment provider or acquirer can tell you which questionnaire applies.

Why do scripts on my checkout page matter?

Malicious or compromised scripts can steal card data as customers type. Controlling and monitoring them is now an explicit requirement.