Who has to comply
Any business that stores, processes or transmits payment card data, whatever its size. For most accounting firms that means card payments for your own invoices, and sometimes card details you see while doing a client's books. Your payment processor or bank will usually ask you to confirm compliance each year with a self-assessment questionnaire.
The twelve requirement areas
- Build and maintain a secure network: firewalls and secure configurations
- Protect account data: limit what you store, and encrypt it in storage and in transit
- Maintain a vulnerability management program: anti-malware and timely patching
- Implement strong access control: need-to-know access, unique IDs, multi-factor authentication, physical security
- Monitor and test networks: logging, log review, vulnerability scans and penetration tests
- Maintain an information security policy, with training and an incident response plan
What is new in version 4
- Multi-factor authentication for all access to systems that handle card data, not only for administrators
- Longer passwords, with a minimum of twelve characters in most cases
- More frequent and more formal review of security logs
- Tighter control of scripts on online payment pages
- Written risk analysis to justify how often certain tasks are done
- Requirements that were phased in became mandatory on March 31, 2025
The best move: shrink your scope
The simplest way to comply is to touch less card data. Use a payment provider's hosted payment page or terminal so that card numbers never pass through your computers. Never keep card numbers in email, spreadsheets or notes. Keep any system that does handle cards on its own separated network.
What a managed provider handles
Firewalls and network separation, multi-factor authentication, patching, log collection and review, scanning and testing, and the written policies and evidence you need for your yearly self-assessment.
This article is general information, not legal advice. Talk to your attorney about how the law applies to your organization.