PCI DSS Compliance
Payment Card Industry Data Security Standard — What Every Business That Takes Cards Must Know
lbttechgroup.com · +1 (916) 333-1062 · Sacramento, California · Veteran-Owned
WHAT IS PCI-DSS?
If your business accepts, stores, or transmits credit card data — PCI-DSS applies to you.
The Payment Card Industry Data Security Standard (PCI-DSS) is a set of security standards established by the major card brands — Visa, Mastercard, American Express, Discover, and JCB — to protect cardholder data and reduce payment card fraud. Any organization that processes, stores, or transmits cardholder data must comply, regardless of size or transaction volume.
PCI-DSS v4.0 became the mandatory standard in March 2025, introducing significant new requirements around authentication, encryption, and continuous monitoring. Organizations that were compliant under v3.2.1 must now validate compliance under the updated standard — and many will find gaps.
$5.56M
avg financial sector breach cost
v4.0
mandatory as of March 2025
12
PCI-DSS requirement domains
100%
of card-accepting businesses in scope
WHO MUST COMPLY
Scope: broader than most businesses realize.
PCI-DSS scope extends to any system component, person, or process that stores, processes, or transmits cardholder data — or that is connected to such systems. Service providers who handle cardholder data on behalf of merchants are also in scope.
Merchant Level
Annual Transaction Volume
Level 1
Over 6 million transactions — requires annual on-site QSA audit
Level 2
1–6 million transactions — annual SAQ + quarterly network scans
Level 3
20,000–1 million e-commerce transactions — annual SAQ
Level 4
Under 20,000 e-commerce or up to 1M other transactions — SAQ recommended
Most Sacramento small businesses fall into Level 3 or 4 — but the security requirements under PCI-DSS v4.0 apply regardless of level. Non-compliance is enforced by acquiring banks through fines, increased transaction fees, or loss of card processing privileges.
THE 12 PCI-DSS REQUIREMENT DOMAINS
What v4.0 requires your business to demonstrate.
Requirement
Description
1. Network Security Controls
Install and maintain network controls to protect the cardholder data environment
2. Secure Configurations
Apply secure configurations to all system components — no vendor defaults
3. Protect Stored Account Data
Limit storage, mask PANs, encrypt or render unreadable any stored cardholder data
4. Protect Transmissions
Encrypt transmission of cardholder data across open, public networks
5. Protect Against Malware
Deploy and maintain anti-malware solutions on all applicable systems
6. Secure Systems & Software
Develop and maintain secure systems; apply security patches promptly
7. Restrict Access by Need to Know
Limit system access to cardholder data to only those with a legitimate business need
8. Identify & Authenticate Users
Strong authentication for all users — MFA now required for all access under v4.0
9. Restrict Physical Access
Restrict physical access to cardholder data and system components
10. Log & Monitor Access
Log all access to network resources and cardholder data; monitor for anomalies
11. Test Security Regularly
Regular vulnerability scans, penetration tests, and intrusion detection
12. Information Security Policy
Maintain a policy that addresses information security for all personnel
PENALTIES & CONSEQUENCES
What non-compliance costs your business.
PCI NON-COMPLIANCE FINES FROM ACQUIRING BANKS
$5,000–$100,000/month
Fines are assessed per month of non-compliance by acquiring banks, escalating with continued violations. Loss of card processing privileges can follow.
Consequence
Impact
Monthly Fines
$5,000–$100,000 per month, assessed by acquiring bank
Increased Transaction Fees
Higher interchange rates applied to non-compliant merchants
Loss of Processing Privileges
Acquiring bank may terminate the merchant’s ability to process cards
Breach Liability
Non-compliant merchants bear full liability for breach-related card replacement and fraud losses
Forensic Investigation Cost
$12,000–$100,000+ for mandatory PFI forensic investigation following a breach
HOW LBT MANAGES YOUR PCI-DSS PROGRAM
From scope definition to continuous validation.
LBT Technology Group delivers PCI-DSS compliance program management as an integrated component of your managed services — covering every requirement domain from network security to policy documentation.
✓ Cardholder Data Environment (CDE) Scoping
Identify all systems, processes, and personnel in scope for PCI-DSS and implement network segmentation to minimize scope and reduce compliance burden.
✓ Gap Assessment Against PCI-DSS v4.0
A formal assessment of your current controls against all 12 PCI-DSS requirement domains, with a prioritized remediation roadmap.
✓ MFA & Access Control Implementation (Req. 8)
Configure and validate multi-factor authentication for all system access — now mandatory under v4.0 for all users accessing the CDE.
✓ Continuous Monitoring & Log Management (Req. 10)
24/7 SIEM monitoring of all access to cardholder data systems, with anomaly detection and alerting that satisfies PCI’s logging and monitoring requirements.
✓ Vulnerability Scanning & Patch Management (Req. 11)
Quarterly ASV-compliant external vulnerability scans, internal scans after significant changes, and critical patch deployment within 30 days.
✓ Written Information Security Policy (Req. 12)
Development and maintenance of a PCI-compliant information security policy covering all personnel, reviewed and updated annually.
Is Your Business PCI-DSS Ready?
Schedule a complimentary scoping consultation. LBT will assess your current compliance posture, identify gaps, and show you exactly what it takes to close them — at no cost and no obligation.
BOOK YOUR FREE PCI-DSS ASSESSMENT →
+1 (916) 333-1062 · lbttechgroup.com · Sacramento, California
© 2026 LBT Technology Group, LLC · PCI-DSS Compliance Services · Sacramento, CA · Confidential