i run an organic food store, and after a conference call with my credit card service (card connect), do i really have to hire a PCI certified professional once a year in order to be pci compliant? If this is the case, how much does it cost?
Or am I just misreading things, i don't think any "cyber criminal" is going to target my business. NCR Silver handles all my credit card transactions.
If you handle credit card numbers, then yes, you have to be certified by a qualified auditor and this certification requires you hiring an external/independent PCI qualified security assessor.
However, you don't have to handle credit card numbers to be able to receive credit card payments. Instead, most smaller merchants use a PCI compliant payment processor like Stripe or PayPal to process card transactions. This reduces the scope of your PCI compliance signficantly, and you can be PCI compliant by just doing the PCI SAQ (Self Assessment Questionnaire), which you can do yourself without hiring a PCI auditor. Depending on your business type and how you handle card payments, there are different SAQs. The SAQ questionnaires will tell you if you need to actually use an auditor, which is primarily based on the volume of your expected transactions, mechanism you integrate with your payment processor, and how you handle card data.
Primarily, you want to outsource as much as possible of your payment processing to the payment processor to reduce your scope and avoid handling card numbers.
Do you need to be cautious about security? If you are using POS(Point of Sale system) a simple reason could be; This Machine is simply request the money transfer. The credit card data being transferred to complete the transaction are sensitive and the whole process needs to be PCI (payment )compliance. You might not have online business but it only means less concern. Anyone can be target of cyber criminals in small or large scale and just a matter of time. Start with PCI SAQ (Self Assessment Questionnaire) and this should give an idea if you still need a professional to run through that.
How much does it cost? Depends on variable that will affect the overall cost, the size and type of business. The larger the organization, the more potential compliance gaps therefore more costly.
i run an organic food store, and after a conference call with my credit card service (card connect), do i really have to hire a PCI certified professional once a year in order to be pci compliant?
You probably do not need to hire a PCI certified professional, because unless you're a particularly large organic food store, you are likely small enough that the Self-Assessment Questionnaire will suffice. (The caveat being that your processor may compel you to have an audit instead of an SAQ, but that would usually only be the case for a small merchant who had a history of compliance problems).
If you've never gone through the process, then hiring an auditor at least once is a good idea. They can help you understand the issues so that handling the SAQ will be easier for you in future years. They can point out security issues that the SAQ might not make apparent to you.
If this is the case, how much does it cost?
That varies widely by the size and location of your business, and by the individual auditor you might engage, so it's impossible for us to say. The standard advice of "get multiple quotes" applies.
Or am I just misreading things, i don't think any "cyber criminal" is going to target my business.
If you handle cards, you are a target of opportunity. They may not know or care who you are, but they'll hit you nonetheless. It's not about your level of profit, it's about the fact that customers hand you cards, and each card represents thousands of potential dollars, and a useful smaller amount of real dollars to the attacker who sells it down the line. PCI DSS is not about employees, it's about infrastructure and practices to protect the cards that have to flit across your business on their way to the processor.
Sure, NCR does a lot to protect the cards - but a necessary step, imposed by the card brands, is to make sure that Merchants do their part also.
Cyber criminals use spam to send fake (phishing) emails. If your business gets caught by one, the attacker has a way into your network, where they will scan for your POS system. Many small businesses have been hacked because their POS service provider was hacked, and all the clients on their list were penetrated. No business is too small, because many criminals are in a different country, and don’t know anything about you or your size. You are just another gold nugget to be mined in the eyes of these criminals.
Why comply with PCI-DSS? Because your business will be held liable for all losses associated with any breach you’re involved in. If you have a customer with a million dollar credit limit on their card, and the thieves who stole it from you use it to buy a Ferrari, you’re liable for the whole amount.
It sounds like you’re a Tier 1 merchant, so take the self-assessment route, if you can. It won’t get you completely off the hook if your POS system is breached, but at least you’ll have someone else to shoulder the burden.
Also, take the opportunity to learn about and convert to EMV chip cards, if you haven’t already. Mag stripes are worthless for security. Chip cards will protect you from a whole host of risks.
