As an example, right after I posted this somebody asked me about a particular shopping cart app and if it was a secure solution. My answer, similar to yours, as long as they redirect to a payment site it should be fine.

Handling credit card data in a secure fashion is no easy task, which is why it’s much better to let others with the resources to do so, tackle that problem.

When small startups try to direct the details and differences between: PCI DSS, PCI PIN, and PCI PA-DSS it can be overwhelming. Throw in acronyms such as DSE, ISO, TPP, and people just stop listening.

That is why it’s very important that we digest the information for our target audience. I’ve taught the information to large and small companies alike in various industries, and each constituent has a different take home message pertinent to they way they do business.

If there is one take home message I would have for your audience it’s that PCI only applies to you if you “store, process, or transmit cardholder data.” Now I don’t have to even define cardholder data before you ask how to get this compliance monkey off your back.

It’s simple, just don’t ever store, process, or transmit cardholder data – let someone else do it for you. In reviewing a shopping cart recently they had two modes of operation:

1) Solutions that don’t require customers to redirect
2) Systems that redirect your customers to a payment site and then back

Small startups want to choose number two because it causes the end user to enter their credit card data at the third-party vendor, instead of accepting it themselves. Even if they only accept it for a second on their one web server, now that server is in scope for PCI compliance.

So, want to do away with PCI? Don’t accept cardholder data online, and let someone else do it for you.

But what if a governing body asks me to validate compliance, or provide them a report stating we are doing everything right? Well, you can confidently fill out the Self-Assessment Questionnaire (SAQ) A. This means you only do card-not-present transactions and all Cardholder Data functions are outsourced. This is only 11 questions, instead of the 224 question long SAQ D (they are labeled A, B, C, and D.)