PCI compliance in 5 minutes a year

Take the 5‑minute PCI survey

You should have received an email about PCI compliance. It links to a short survey that you complete once a year. That survey is how you become PCI compliant with us.

1. Find the PCI compliance email. Check your junk folder if you do not see it.
2. Open the survey and answer the questions. It takes about five minutes.
3. Submit it. You are done until next year.

Why it is so short

Our systems are PCI compliant, so the survey is not checking the equipment we gave you. It is mainly making sure you are not also taking cards some other way that is not compliant.

What you get for doing it

Completing the survey gives you $100,000 of insurance in case anyone does hack into the system.

What PCI is, in plain words

PCI DSS stands for Payment Card Industry Data Security Standard. It is a set of security rules, backed by the card brands, for any business that takes card payments.

• Size does not exempt you. The PCI Security Standards Council says the standard applies to all merchants, whatever their size or number of sales.
• Small shops have less to do. The Council also notes that small merchants usually have simpler setups, with less card data and fewer systems to protect, which reduces the effort.
• Your processor sets the paperwork. Whether and how you must prove compliance is decided by the card brands and your acquirer, which is the company that processes your card payments.

What you do each year

The survey in chapter 1 is your version of what the industry calls a Self-Assessment Questionnaire, or SAQ. You fill it in yourself. No auditor visits.

1. Answer the questions. The SAQ is a series of yes-or-no questions about how you protect card data.
2. Fix any "no." If you answer no, you may be asked for the date and the action you will take to put it right.
3. Sign the attestation. The Attestation of Compliance comes packaged with the questionnaire. It confirms you were eligible to use that SAQ and completed it.
4. Submit it. With us, all of this happens inside the online survey from your PCI email.

Find the questionnaire that fits you

There are several SAQs. Which one you use depends on how you accept cards, and the simpler your setup, the shorter the form.

• A shop that only takes cards on payment terminals answers far fewer questions than one that stores card data on its own computers.
• Adding a new way to take cards, such as an online store or keyed-in phone orders, can change which form applies.
• You do not have to pick one. The survey asks a few questions about how you take cards and works it out for you.

Secure your Wi-Fi

Genius devices often run on Wi-Fi, and PCI expects a wireless network to be as secure as a wired one. Genius publishes its own guidance on this.

• Turn on encryption. Use WPA2, or WPA at minimum. WPA2 is the stronger of the two.
• Keep the POS network separate. Customer or guest Wi-Fi should not share a network with your payment devices. Separating them takes a firewall between the two.
• Watch for unknown devices. Check from time to time that nothing unfamiliar has joined your network.

Use a strong Wi-Fi password

• 12 to 14 characters or more
• Upper and lower case letters, numbers and symbols
• Random, with no names, birthdays or keyboard patterns
• Not reused anywhere else

Protect your devices and logins

A card reader someone can tamper with, or a login everyone shares, is a risk. These habits come from Genius's own security guidance and the tools already in the POS.

Physical security

• Let only trusted people use the payment devices.
• Store handhelds in a secure place when they are not in use.
• Keep devices where staff can see them and customers cannot reach behind them.

Logins

• One login per person. Give each staff member their own user and PIN in the Portal, so every action is tied to a name.
• Lock when you step away. Tap Lock on the POS. It also locks itself after 15 minutes without use.
• Limit permissions. Give refund, discount and management access only to those who need it.
• Remove leavers. Deactivate a user the day they stop working for you.

Never keep card details

The simplest way to stay compliant is to let the card reader do the work and keep nothing yourself. The less card data you hold, the less you have to protect.

• Do not write card numbers down. No notepads, order forms, spreadsheets, emails or text messages.
• Never keep the security code. The three or four digit code on a card must not be stored after the payment, by anyone.
• Prefer the reader. Have the customer insert, tap or swipe. Key a card in by hand only when you must, and keep no record of the number.
• Do not photograph cards or ask customers to send a picture of one.
• Shred paper that shows a full card number.

Stay compliant through the year

Compliance is not a one-day task. It lasts as long as your habits do.

• Renew every year. Watch for the PCI email and do the survey within 60 days, so the $200 monthly fee never applies and your $100,000 of insurance stays in place.
• Tell us about changes. A new device, an online store or a new way of taking cards can change your answers, so call the PCI team before the next survey.
• Train new staff on the device and card data rules in chapters 6 and 7 before they take payments.
• Keep software current. Let the POS update and sync, so it runs the latest version.

If you suspect a problem

If a device looks tampered with, or you think card data has been exposed, stop using that device and call us straight away.

Free help from the PCI Council

The Council publishes a plain-language Guide to Safe Payments for small merchants and an online evaluation tool for a first check of your security.