We take POS and online payments, what is PCI DSS and what are our actual obligations?

The bank just sent a boilerplate automated email. For small businesses that don't store card data, PCI DSS is not a nightmare. What matters is whether the payment form on your site is genuinely an iframe, or if the card data first hits your server before going to the bank. If it's the latter, your obligations become way heavier.

Talk to your web developer, confirm whether the input fields where card numbers are entered are loaded directly from the third-party payment provider's servers. If you're using an iframe, you'll fill out SAQ-A, which is only about 20-25 basic operational questions.

We got the exact same email last year, and our accountant got scared and suggested we hire an external audit consultant for 80,000 TL. Then we called the bank's technical support and they told us 'if you don't store cards on the site, just fill out and submit the SAQ form in the portal and you're good.' Solved it in 15 minutes.

If an inspection happens on the store side, keep these two things in mind to avoid penalties: 1) Make sure the middle digits of the card number are masked on receipts printed by the POS terminal. 2) Ensure security cameras aren't pointed directly at the POS PIN pad at the register.

We use a turnkey e-commerce package too, if we just forward this form to the platform provider instead of asking the bank can they fill it out on our behalf?

The self-assessment questionnaire legally must be signed off by an authorized representative of your business. Requesting their own PCI DSS certificate of compliance from your platform provider and submitting it to your bank as supporting documentation will speed up the process.

If you aren't storing card data in any way, nothing to worry about, just submit the SAQ-A form in the portal and move on.

We experienced almost the exact same thing last year. The biggest time-waster for us was not knowing who had the final say.

An untested backup is not a backup. Proven by experience.

I'll try it.

You're right.

Let me summarize what's been said so far. When we decide without measuring, we always end up in the same place.

Security isn't absolute; it's about making attacks not worth the effort. If I were you, I'd go this route.

The discussion got scattered, let me summarize. Most time waste accumulates in tasks waiting for approval.

Hope this helps.

I don't think this advice fits everyone. like if 2FA is on, a stolen password alone is useless.

I'm also curious if anyone does it differently.

Timely topic.

I went through the same thing. Don't rely on a single measure; go layer by layer.

If you post the result here, it will help others too.

I didn't know that. Solutions that work at a small scale collapse when you grow; I learned this late.

Solutions that work at a small scale collapse when you grow; I learned this late. Proven by experience.

I have no experience with what is the pci dss standard, so I'm asking. If 2FA is on, a stolen password alone is useless.

When you try to change everything at once, nothing settles. Good luck with that.

thanks a lot Ill try it today.