If a business processes credit cards and wants to avoid PCI-DSS burdens, what option exists?

• A. A third-party processing vendor that is PCI-DSS compliant.
• B. Ignore PCI-DSS requirements.
• C. Self-certify PCI-DSS without any vendor.
• D. PCI-DSS obligations apply only to online sales.

Answer: (A)

The main idea here is that you can reduce PCI-DSS burdens by offloading card data handling to a PCI-DSS compliant processor. When you route credit card transactions through a vendor that isPCI-DSS compliant and you don’t store or process card data on your own systems, most of the PCI controls and audits occur on the vendor’s side. That means your own environment has a smaller scope and you’re relying on the vendor’s security program to protect cardholder data, which is often much more practical for many businesses. Of course you still need to ensure you integrate securely, use proper data flows, and verify the vendor’s compliance status, but this approach typically minimizes the work you must do to stay PCI-compliant.

Why the other ideas don’t fit: ignoring PCI-DSS requirements isn’t a viable or safe option; PCI-DSS isn’t something you can simply bypass. Self-certifying without any validation isn’t how PCI-DSS works—formal validation or completion of an approved Self-Assessment Questionnaire (SAQ) and, for certain merchants, a review by a assessor is required. And PCI-DSS obligations apply to any merchant that processes card payments, whether online or in person, so it isn’t limited to online sales.