Clear Path step · Business · Your industry's rules and risks
Keep card data out of your systems
Why it matters: Data you never store can't be stolen from you. Outsourcing card handling shrinks your PCI scope and your breach risk at once.
On your path if you picked “Retail and e-commerce” for “What's your industry?”.
Do it
- Confirm with your processor that online payments use a hosted or embedded payment page from them.
- Use processor-supplied, updated card terminals in store.
- Ask which PCI DSS v4.0.1 SAQ applies and complete it yearly.
- Never write down or email full card numbers.
Check it worked: Card numbers never touch your systems: payments run through your processor's hosted page or payment terminal, and you know which PCI self-assessment questionnaire applies.
Simply put
It's like letting a security company carry the cash instead of keeping it in the till. Card numbers that never touch your systems can't be stolen from them, and your PCI paperwork shrinks, though your payment page still needs watching.
In detail
Even with a hosted payment page, the page that loads it can be tampered with. That's why PCI DSS 4.x requires control of scripts on payment pages, and why merchants who embed a processor's payment form must confirm their site isn't open to script attacks to use SAQ A; ask your processor what that means for you.
If this is new to you: Not sure how your payments work? Ask your processor two questions: do we use your hosted payment page, and which self-assessment questionnaire applies to us? Their answers set the rest.
Points toward the Long View: a store that holds no card data worth stealing.