I documented my experience helping some small businesses respond to their PCI DSS self-assessment questionnaires. There's no way they could be expected to understand what was being asked. medium.com/@jtrentadams/pci-…

Perhaps the thought is if they don’t understand the questions, then how can they be trusted to protect credit card data? Maybe it’s a way to ensure they reach out to someone that has that expertise, or to push them to services that handle the PCI details for them.

Based on my (small) sample size, my conclusion is there’s no way PCI DSS is anything more than security theater and liability adjustment when dealing with SMBs.