DSS compliant. Is this required? My small business accepts credit cards when we travel to trade shows around the country. Last year I was contacted by e-mail and told that I needed to purchase a plan from a company to protect the information from my customers. They said I needed to be PCI DSS compliant. Is this a scam? Is this something I should keep doing? How does something like this protect anyone? As I recall the cost was several hundred dollars. It is time to renew, and I want to be sure that this is legitimate.