# PCI DSS

The card industry's security rules for any business that takes cards.

No statute creates it, though Nevada, for one, requires by law that a business there taking cards comply. Elsewhere it reaches a business through the merchant agreement with whoever processes its cards, which is why it survives a change of owner exactly as far as that contract does and no further. What a buyer inherits is the gap: an old terminal, a point of sale system holding card numbers it should never have kept, a self assessment nobody has completed since the last owner did one. After a breach the card brands assess the processor and the processor charges the merchant, so a business with no compliance file has an open number sitting on it. Ask for the last attestation and who signed it.

In numbers: A restaurant taking 40% of its revenue on cards is inside the rules whatever its size, and the card brands' assessment after a breach is levied on the processor, which passes it to the merchant.

Source: https://searchspheresource.com/glossary/pci-dss
Not dated: A definition is editorial: what a term means, why it matters, and an example. None of it reads a source that can go stale, so there is no date to take and a stamped one would be the build time wearing a costume.

Site index for machines: https://searchspheresource.com/llms.txt