Need help understanding. What is PCI DSS Certification and why do I need it?

I would assume this is for a business and the business may store sensitive data or process credit card transactions? I do IT for grocery stores and I deal with PCI compliance all the time. They just want to make sure that your network does not have any known vulnerabilities on it. There are companies that can run a scan to check for these vulnerabilities. Your hardware/software must be PCI DSS certified in order to be compliant or they will charge you a non compliance fee.

If zero is the number, you don't need it. If its more than zero, you need to be PCI compliant, else you risk fines from the credit card processors.

quote:

---

risk fines from the credit card processors.

---

LOLZ. I watched a company with 7 billion in annual revenue get fined $50k a month for non compliance by *one* of the card brands, for nearly two years until we cleaned them up. The fines are generally a joke. ETA, nearly all of the revenue came from payment cards.

The only two things that make merchants pay attention is the threat of changing the transaction rate, and the threat to cut off access to the processing network, which I've never seen done.

Sounds like your questions have been answered. There are several levels of pci compliance. If you’re just using an old credit card machine, your pci compliance check is limited to a questionnaire. If cards are hitting your system but not being stored, it’s an elevated risk but not too terrible. If you’re storing data, you get the rubber glove treatment.