Cyber Security for Retail and E-commerce: PCI, Cyber Essentials and Testing

Cyber security for retail starts with the card payment. Any business that accepts cards must comply with PCI DSS, and the way you take payments in stores, online and over the phone decides how much of the standard applies and how you prove it. Around that sits a baseline for the rest of the business, usually Cyber Essentials, and testing of the systems criminals target most: the online shop, customer accounts and the store network. Each section below summarises one area and links to the guide that covers it in depth.

What does cyber security for retail cover?

Every retailer needs three things: PCI DSS compliance for each payment channel, a baseline of technical controls across the business, and independent testing of the systems that handle payments and customer accounts. What changes between businesses is the mix.

The decision that changes your workload most is which Self-Assessment Questionnaire (SAQ) you are eligible for, and that depends on exactly how each channel takes cards. Our guide to which PCI SAQ is right for you works through it question by question, and our free PCI compliance check suggests your likely SAQ with a prioritised fix list. The largest merchants (Level 1 under Visa and Mastercard rules, with more than 6 million transactions a year on one brand) validate with a Report on Compliance instead, usually completed by a QSA. Every SAQ and the standard itself are free to download from the PCI SSC document library.

What are the most common cyber attacks on retailers?

Retailers are targeted for card data, customer accounts and the disruption that pressures a business to pay. Four attacks come up again and again:

Ransomware and phishing against head office follow the same pattern as in any business, which is where the Cyber Essentials controls below help. Each of these attacks is covered in more depth in the sections that follow.

How do stores protect card terminals and networks?

By using approved terminals, checking them for tampering and keeping them off the networks everything else uses. PCI DSS v4.0.1 Requirement 9.5.1 asks merchants to keep an up-to-date list of point-of-interaction devices, inspect them periodically for tampering or substitution, and train staff to spot suspicious behaviour and to check the identity of anyone who claims to be there to repair or replace a device.

Store networks are the other common gap. Tills, kiosks, guest Wi-Fi, CCTV and stock scanners sharing one flat network bring everything into PCI DSS scope. Segmenting payment systems from the rest reduces scope, and a PCI-validated point-to-point encryption (P2PE) solution reduces it further, because card data is encrypted inside the terminal before it reaches your systems.

The back office needs the same basics as any business. Cyber Essentials certifies five technical controls (firewalls, secure configuration, security update management, user access control and malware protection) across every PC, tablet and cloud service your staff use; the NCSC’s Cyber Essentials overview explains the scheme. It does not replace PCI DSS, but it closes common gaps attackers use to get a first foothold.

What does an online shop need beyond a payment gateway?

A gateway handles the card, but the shop around it is still yours to secure. Each point below has its own guide:

• Payment page scripts. Since 31 March 2025, PCI DSS 6.4.3 and 11.6.1 require controls over scripts on payment pages and detection of unauthorised changes. Our guide explains who they apply to after the January 2025 change to SAQ A and how skimming attacks work. Skimmed details feed card-not-present fraud, which usually reaches merchants as chargebacks.
• Gateway choice. A PCI compliant payment gateway reduces your scope but does not make your shop compliant. Ask for its Attestation of Compliance and responsibility matrix.
• Platform. Magento and Adobe Commerce stores carry extension, admin panel and patching risks of their own, covered in our Magento PCI compliance guide.
• Scanning. Where your SAQ requires quarterly external scans, they must be run by a PCI SSC Approved Scanning Vendor. We deliver ASV scanning through our PCI SSC Approved Scanning Vendor partner and help you fix and rescan failures.
• Testing. E-commerce penetration testing, such as a website penetration test, checks the shop itself: login and account pages, admin panels, plugins, the checkout flow, and the business logic behind discount codes, gift cards and loyalty points. If customers shop or collect loyalty points through your own app, mobile app penetration testing covers the app and the APIs behind it.

Do hotels need to be PCI compliant?

Yes. Any hotel that accepts card payments must comply with PCI DSS, and hotels take cards in more ways than most businesses: at reception, over the phone, by email, through a booking engine on the hotel website, from online travel agents and as pre-authorisations held until checkout. Each route needs to be mapped before you can work out what applies.

The issues that come up most in hospitality:

• Card details in email and on paper. Sensitive authentication data, including the card security code, must never be kept after authorisation (Requirement 3.3.1). Security codes left in mailboxes, booking form records or front desk notes after authorisation break that rule.
• Phone bookings. Card numbers read out over the phone bring call recordings, desk phones and staff into scope unless you use a descoping method. Our guide to taking card payments over the phone compares the options.
• Property management systems and booking engines. Find out whether your PMS stores full card numbers, and collect an Attestation of Compliance from each booking engine, channel manager or payment provider that handles card data for you. PCI DSS Requirement 12.8.4 asks you to monitor their compliance status at least once every 12 months.
• Groups and franchises. Every property’s payment channels need to be covered, and the split of responsibilities between brand, management company and owner should be written down.

Do restaurants and bars need PCI compliance?

Yes, any restaurant, bar or café that takes cards must comply. Standalone pay-at-table terminals keep the card in the customer’s hand and usually mean a short SAQ. QR-code and online ordering are lower risk when the provider hosts the payment form. EPOS tablets that key in card numbers, or an ordering site built in-house, bring much more of the standard into scope, so check how each system handles card data before you choose it.

How should retailers prepare for peak trading?

Test early enough to fix findings before the change freeze. Peak periods such as Black Friday and Christmas bring more traffic, more promotional code and more attacks on logins and gift cards, while change freezes delay fixes. A workable plan:

Why Sovereign Secure for retail and hospitality?

• PCI SSC-approved Qualified Security Assessor (QSA) company, Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA), and a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028.
• IASME-licensed Cyber Essentials certification body, issuing CE and CE+ certificates, with basic certification from £320 + VAT.
• ISO consultancy beyond information security, including ISO 22000 certification for food retailers, caterers and hospitality kitchens.
• Penetration testing of websites, web applications, APIs, mobile apps, store and head office networks, and payment devices including POS and PIN terminals, plus vulnerability scanning. External ASV scans are delivered through our PCI SSC Approved Scanning Vendor partner.
• Retail, ticketing and hospitality clients shown on our site include JCPenney, Ticketmaster and Accor, and Albertsons has given us a testimonial.

What should you do next?

List how you take cards in each channel (stores, website, phone, email, booking engines and apps) and which providers handle them. Send that to us through the enquiry form on this page, choosing “PCI DSS Assessments”, or call +44 161 523 5276. We will tell you which SAQ or assessment applies, what testing you need before your next peak, and send a fixed quote.