I prefer to put consequences in terms of money.<p>That said, on the flip side, because of things like &quot;Dual Control&quot; the PCI DSS is physically impossible for some small companies to abide by.  In the past we dealt with credit cards and had a few audits, and they admitted that many of the points are aimed at companies that don&#x27;t consist of just two people.<p>Also, look at it from their POV.  In a normal course of business a lot of these mom and pops probably already are storing credit card information on paper and&#x2F;or in word documents.  So you&#x27;re saying the system you build for them is going to be, in some ways, less useful than their current ad-hoc system.<p>My mom &amp; pop tax guy emails me my tax return as an encrypted pdf, with the password being... the last 4 digits of my SSN.