You’ve got a smart, lean startup with a product that will solve real problems. But if you’re like many ventures that deal with sensitive data, your business may fall under the Payment Card Industry Data Security Standard (PCI DSS) scope. And something that should be simple becomes a roadblock.
PCI DSS is mandatory for businesses operating on cardholder data. And consumers expect you to protect their sensitive credit card information. But at what cost?
With 12 complex requirements, a PCI compliance certification isn’t a quick or cheap certification. In fact, depending on the size and nature of your business, fulfilling PCI DSS requirements can be cost-prohibitive. And even if you can afford the six months to a year of preparation and analyzing and a million dollars in fees, what about the maintenance costs? PCI DSS doesn’t end at certification.
Several variables go into developing and maintaining a PCI-compliant cardholder data environment (CDE), and it can be tough for early-stage companies to gauge how much they should expect to spend or how many engineers they might need to hire.
That’s why we’ve laid out the different costs and requirements necessary to achieve PCI compliance for startups.
Table of Contents
Why become PCI compliant in the first place?
Even though the PCI Security Standards Council – which is made up of card brands such as Visa, MasterCard, Discover, JCB International, and American Express – requires it, PCI compliance is more than checking off boxes on a requirement checklist.
For starters, PCI compliance is an obstacle that can prevent your business from even getting off the ground. PCI DSS compliance is mandatory. So if you can’t afford it or raise enough funds to invest in creating a compliant infrastructure, you’re done.
What all founders and entrepreneurs should understand is that startups aren’t using PCI DSS to stand out from their competitors – they’re using it to gain entry into the market.
Carefully following PCI standards comes with two key benefits:
- Setting up the information security and access control policies required by PCI DSS helps prevent data breaches involving cardholder information – which saves you time and money in the long-run.
- The PCI compliance certification demonstrates to your customers that you value data security and will handle their cardholder data with caution and care.
Still, PCI compliance can be a confusing process. If it feels overwhelming, there are really only three routes you can take to achieve your PCI DSS certification.
Three approaches to PCI compliance
There are generally three paths that a startup can take to acquire its certificate. Each requires a different level of labor, expertise, and cash.
Expensive and labor-intensive: DIY compliance
The DIY approach usually involves months of work to achieve the initial PCI certification. But that isn’t the end of it.
A PCI DSS certification audits highlight your compliance at a specific point in time, based on how your systems look at that moment. In other words, if you change your system, you have to update your PCI certificate. Any modification or addition of new features immediately invalidates your compliance certificate, because the changes have not been audited.
If your company adds or changes features or connectivity often, this becomes a non-stop hamster wheel of follow-uping with revalidations just to maintain PCI compliance. This of course costs more money, but it also takes resources away from your core business.
Combining vendors with your in-house approach
What about if you want to onboard a vendor or two to help with part of the process, like a payment processor? Startups often find this method favorable, since it reduces their workload and possibly some of their scope.
However, the average cost per day of software implementation professional services is $2,500. Combine however many days this option would take with the other DIY steps you are working on in-house, the price tag can balloon.
Keep in mind that because part of your infrastructure is still in-house. This means you will still be in PCI scope and your startup will be liable for any data breaches or cybersecurity event.
A safer, more cost-effective path to PCI compliance
While outsourcing parts of the process to specific vendors has been around a while, what if you could outsource all the aspects of PCI compliance to a third-party?
Consider how all-in-one platforms like Amazon Web Services (AWS) work. When startups need a cloud computing system, they don’t build their own from the ground up – they use AWS. In exchange for a subscription fee, AWS does all the heavy lifting, offers support, and is often less expensive than the alternatives.
With an all-in-one, AWS-like solution that takes care of all your PCI data security responsibilities, you can essentially “set it and forget it”. This means you can spend more time, money, and other resources on what really matters – scaling your business.
Very Good Security (VGS) provides its users with an “always current” data privacy solution that ensures you are constantly up to date on your PCI compliance validation, as it handles all your company’s collection, transfer, and storage of sensitive user data on your behalf.
Our data aliasing technology allows startups to operate on their sensitive data as if it were in their systems, while not taking on the liability of actually possessing that data. With VGS’ Zero Data solutions, you can skip every step from the gap assessment to ongoing maintenance. This can mean saving up to 75% of PCI costs while gaining compliance in weeks rather than months.
Focus on what’s important
As an entrepreneur, you should be focusing on your product, not being a compliance expert. While PCI DSS compliance is mandatory, it is a headache. But now startups have more options than the cost-prohibitive DIY approach. Offloading select services to professionals or even outsourcing the entire process can cut down on the time and expenses a startup needs to delegate to compliance measures. This frees you up to focus on what really matters: Building your business.
About Carson Derrow
