PCI DSS Compliance
For any business that takes card payments: the network segmentation, device controls, scanning, logging and training PCI DSS requires, and a completed self-assessment questionnaire your processor will accept.
Overview
The processor sends the questionnaire every year. Most small merchants tick the boxes and hope.
If you accept cards, your processor requires you to comply with the Payment Card Industry Data Security Standard and to attest to it, usually through an annual self-assessment questionnaire. The questions are technical — about network segmentation, default passwords, encryption, logging, vulnerability scanning, access control and training — and most small merchants answer them without really knowing whether the answers are true. That works until there is a breach, when the attestation becomes a liability and the fines follow.
We make the answers true. The first job is scoping: the fewer systems that touch card data, the less there is to secure, so we isolate payment terminals and point-of-sale systems on their own network segment and keep card data off office computers entirely where possible. Then the controls on what remains: secure configuration, patching, endpoint protection, logging, quarterly vulnerability scanning where your questionnaire requires it, access limited to the people who need it, and staff trained on handling cards. Finally we help you choose the right questionnaire for how you actually take payments and complete it with evidence behind each answer.
We are not a Qualified Security Assessor or an Approved Scanning Vendor. For the small-merchant self-assessment path, which is where most of our clients sit, those are not required; where they are, we work alongside them.
Capabilities
What's included
- Scoping and segmentationPayment systems isolated on their own network segment so the rest of the business is out of scope.
- Secure configuration and patchingNo default passwords, unnecessary services off, systems patched — on terminals, POS and the network.
- Vulnerability scanningInternal scanning continuously and, where your SAQ requires it, quarterly external scans by an approved vendor.
- Access control and loggingAccess to card-handling systems limited and logged, with logs retained as the standard requires.
- Staff training and policiesCard-handling procedures and security awareness training, with records.
- SAQ selection and completionThe right self-assessment questionnaire for how you take payments, completed with evidence.
How It Works
Delivered through managed IT
Configuration, patching, endpoint protection and vulnerability status for in-scope systems are managed and recorded in NinjaOne, our enterprise management platform, so most of the technical questions on the SAQ are answered by reports rather than by memory. Network segmentation is designed and documented by our engineers.
Why Atlas
Secure. Reliable. Responsive.
Flat monthly fee
Predictable per-device pricing. No surprise invoices and no hourly meter running while your team waits for help.
Proactive, not reactive
Monitoring, patching, and automation run around the clock — so most issues are resolved before your staff ever notice them.
Responsive & accountable
One team that knows your environment and answers fast. You reach a real technician, not a ticket queue in another time zone.
Month-to-month
We earn your business every month. No multi-year lock-in — you stay because the service works, not because a contract traps you.
Common Questions
Questions we get asked
We only use a card terminal. Does PCI really apply to us?
Yes, although the obligation is lighter. A merchant using a standalone terminal that does not touch the office network typically qualifies for one of the shortest questionnaires. The work is confirming that is genuinely how your payments flow — no card numbers written down, emailed or typed into an office computer — and keeping the terminal and its connection secure.
Which SAQ do we need?
It depends on how you take payments: a standalone terminal, an integrated point-of-sale system, an e-commerce site that redirects to a payment page, or one that handles card data itself. Each path has its own questionnaire with a different number of requirements. Choosing wrongly is common and means attesting to the wrong things. We walk through your payment flows and pick the right one with you.
What is network segmentation and why does it matter so much?
Putting the systems that handle card data on their own part of the network, separated by a firewall from everything else. It matters because PCI applies to every system that can reach card data. Segment well and a dozen requirements apply to one terminal and one switch instead of to every computer in the building.
Do we need quarterly external scans?
Some questionnaires require quarterly external vulnerability scans by an Approved Scanning Vendor, mainly where systems facing the internet are in scope. Others do not. If yours does, we arrange the scans, fix what they find and keep the passing reports. Internal vulnerability management runs continuously regardless, because the standard expects known weaknesses to be addressed.
What happens if we are not compliant and there is a breach?
The card brands and your processor can impose fines and increased fees, you may bear the cost of fraud and card reissuance, and in a serious case the ability to accept cards can be withdrawn. An honest, evidenced attestation does not make a breach impossible, but it changes the conversation entirely about whose fault it was.
Secure. Reliable. Responsive.
Book a consultation and we’ll map out a managed IT plan for your business. contact@atlasbm.net · (417) 619-6518