When retailers sign a agreement which has a payment processor, they agree to be matter to fines should they are unsuccessful to take care of PCI DSS compliance. PCI compliance is split into four stages, based on the once-a-year range of credit rating or debit card transactions a business procedures. https://www.nathanlabsadvisory.com/blog/nathan/the-top-benefits-of-using-ciso-as-a-service/