Retail Store IT Checklist: POS, PCI, Wi-Fi and Cameras

A retail shop’s IT has six jobs: keep the point-of-sale (POS) system ringing up sales, keep card data out of reach, give customers Wi-Fi that cannot touch the registers, record usable camera footage, keep in-store and online inventory in agreement, and make sure seasonal staff lose access when the season ends. This guide explains each one, the payment card rules behind them, and ends with a checklist and questions to ask any IT provider.

What Does a Retail Shop Actually Run?

System	Common examples	Notes
POS and inventory	Square for Retail, Shopify POS, Lightspeed Retail, Clover	Cloud based; the register is usually a tablet or an all-in-one terminal
Payment terminals	The POS vendor’s card reader or countertop terminal	The device that reads the card is the heart of PCI scope
Peripherals	Barcode scanners, receipt printers, label printers, cash drawers	Often the source of day-to-day faults
Online store	Shopify, Square Online, WooCommerce	Shares inventory with the POS, natively or through a connector
Guest Wi-Fi	Business access points	Internet access only
Cameras	Recorder-based or cloud cameras	Need storage and their own network
Back office	A PC or laptop, email, accounting, shared files	Holds supplier, payroll, and customer information

Because the POS is cloud based, the shop’s own network and internet connection carry more weight than any single computer. A register that cannot reach the internet falls back to the vendor’s offline mode, if it has one, and the terms of that mode matter. Square, for example, requires offline payments to be uploaded within 72 hours on its Register and Terminal (24 hours on readers and stands), and holds the seller responsible for any that are declined or disputed. Read your own vendor’s offline documentation before you need it.

What Does PCI DSS Mean for a Small Shop?

PCI DSS (the Payment Card Industry Data Security Standard) is the rulebook the card brands apply to every business that accepts cards. It reaches you through your contract with your payment processor. The only active version is PCI DSS v4.0.1, since v4.0 was retired on December 31, 2024.

Small merchants normally validate once a year with a Self-Assessment Questionnaire (SAQ). Which one depends on how you take cards. The PCI Security Standards Council lists the types:

SAQ	Fits a shop that…
A	Sells online only through a fully outsourced checkout, with no in-person card handling on that channel
B	Uses standalone dial-out terminals with no electronic card data storage
B-IP	Uses standalone approved terminals connected over the internet and kept apart from other devices
P2PE	Uses only hardware terminals from a validated, PCI-listed point-to-point encryption solution
C	Runs a payment application on internet-connected systems without storing card data
D	Does not fit any other type

Three practical points:

1. Your processor decides. Ask which SAQ applies and when it is due. Some all-in-one platforms remove the paperwork: Square states that sellers using it for all card storage, processing, and transmission do not need to validate PCI compliance individually.
2. A shop with a website may have two channels. The in-store terminals and the online checkout are assessed according to how each one handles cards.
3. Online checkout rules tightened in 2025. For SAQ A merchants, the Council added an eligibility criterion from March 31, 2025: the merchant confirms the site is not susceptible to attacks from scripts that could affect its e-commerce system. On a hosted platform, ask the platform how it covers this. On a self-hosted store such as WooCommerce, it is your job, which means disciplined plugin updates and limits on third-party scripts.

The Council’s free Guide to Safe Payments names the usual causes of small merchant breaches: weak or default passwords, insecure remote access, and unpatched software. Our PCI DSS overview for small businesses goes further into the requirements.

How Should the Shop Network Be Set Up?

The goal is to shrink PCI scope (the set of systems the standard applies to) down to the payment devices, and to stop a problem in one area from spreading. That is done with network segmentation: splitting one physical network into separate virtual networks (VLANs) that cannot reach each other.

A workable layout for a single shop:

1. Payments and POS: registers, card terminals, receipt printers. Nothing else.
2. Back office: the office PC, label printer, staff devices.
3. Guest Wi-Fi: internet only.
4. Cameras: cameras and recorder.
5. Everything else: music players, smart TVs, thermostats, and similar devices that rarely get security updates.

This needs a business-grade firewall, a managed switch, and access points that can broadcast more than one network. Our network segmentation guide and small business firewall guide explain the hardware.

For coverage, place access points where card readers and inventory tablets are actually used, including the stockroom. Shelving, refrigeration, mirrors, and stucco walls all weaken signal. Our post on why Wi-Fi keeps dropping walks through placement and interference.

Guest Wi-Fi Isolation

If you offer customer Wi-Fi, set it up so that:

• It is a separate network from the registers, with firewall rules that block any route between them.
• Client isolation is on, so guest devices cannot see each other.
• Each device has a bandwidth cap, so one video stream cannot slow card authorizations.
• The password (or splash page) can change without touching any business device.

Guest Wi-Fi is optional. If customers do not ask for it, not offering it is a reasonable choice.

What Should a Shop Know About Cameras?

Useful footage depends on a few decisions made at installation:

• Placement: cover the entrance at face height, the register, the stockroom door, and the receiving area.
• Retention: decide how many days of footage you need, then size storage to match. Higher resolution and more cameras shorten retention on the same drive.
• Network: cameras and the recorder get their own network and new passwords. For remote viewing, use the vendor’s app or a VPN, not open ports on the firewall.
• Updates: recorders and cameras need firmware updates like any other computer.

California law shapes the setup too. Penal Code 632 restricts recording confidential conversations without the consent of all parties, so leave camera microphones off unless you have legal advice that supports using them. Labor Code 435 bars employers from recording employees in restrooms, locker rooms, and rooms designated for changing clothes. Fitting rooms raise similar privacy concerns; keep cameras out of them and ask an attorney if in doubt. Our security camera guide covers system types and storage.

How Do You Keep the Online Store and the Register in Sync?

Overselling happens when two systems each believe they own the stock count. To avoid it:

1. Pick one source of truth for inventory. Usually the POS or the e-commerce platform, not a spreadsheet.
2. Prefer a native pairing where one exists (Shopify POS with a Shopify store, Square for Retail with Square Online). If you need a third-party connector, learn how often it syncs and what happens when it fails.
3. Test the edge cases: returns, exchanges, online orders picked up in store, and items sold in both places within the same minute.
4. Protect the admin accounts. The owner login for the online store, the domain registrar, and the POS back office should each use a unique password and multi-factor authentication (MFA, a second proof of identity such as an app code).
5. Own your domain. The domain name and DNS should be registered to the business, in an account the owner controls, not to a former web designer.

How Should Seasonal Staff Accounts Work?

Holiday and summer hires are where access control usually slips. A simple routine keeps it tidy:

• One login per person. Individual POS PINs make voids, discounts, and refunds traceable.
• Least privilege. Seasonal staff get a cashier role. Refunds, discounts above a set level, and inventory adjustments stay with managers.
• Set an end date on day one. Note the expected last day when you create the account, and review the list weekly during the season.
• Same-day removal. Disable the POS login, email, scheduling app, and alarm code the day someone leaves, and change any shared Wi-Fi password they knew.
• Avoid shared email. If seasonal staff need email, give them their own mailbox and remove the license afterward.

Our onboarding and offboarding checklist has a template you can adapt.

What About Backups?

A cloud POS keeps sales and inventory data on the vendor’s servers, so a dead register does not lose it. Two gaps remain. First, export key reports (inventory, customers, sales history) on a schedule, so you hold a copy outside the vendor’s system. Second, the back-office computer still holds supplier files, payroll documents, and photos that need a proper backup. Our business data backup guide explains the options.

Retail IT Checklist

• Registers and card terminals are on their own network
• Guest Wi-Fi is isolated, rate limited, and cannot reach any business device
• Cameras and recorder are on their own network with new passwords and no open firewall ports
• Camera audio is off, and no camera covers restrooms, changing areas, or fitting rooms
• Default passwords are changed on the router, switch, access points, and printers
• You know which SAQ your processor expects and when it is due
• Card terminals are checked regularly for tampering or swapped devices
• Staff know what the POS offline mode allows and its time limit
• Every employee has an individual POS login with the right role
• Seasonal accounts have an end date, and former staff are removed
• MFA is on for POS admin, online store admin, email, domain registrar, and banking
• One system is the source of truth for inventory, and sync failures raise an alert
• Online store plugins and themes are updated on a schedule
• POS reports are exported regularly, and the office PC is backed up
• A contact sheet lists the ISP, POS vendor, processor, and IT support, with account numbers

Questions to Ask Any IT Provider

• How will you keep the payment devices separate from guest Wi-Fi, cameras, and smart devices?
• Have you read my POS vendor’s network requirements?
• Will I get a network diagram and every admin password?
• How do you schedule work around opening hours and peak season?
• What happens when a fault sits between the network and the POS vendor?
• How are scope and price agreed before work starts?
• What would you leave alone? A good answer includes things that do not need changing.

When You Do Not Need All of This

A market stall or small boutique with a single tablet, one card reader, no guest Wi-Fi, and no cameras has little to segment. Strong passwords, MFA on the POS and email accounts, automatic updates, and a spare charged reader cover most of the risk. The fuller setup earns its cost once you add registers, cameras, guest Wi-Fi, an online store, or seasonal staff.

Common Questions

Does PCI DSS apply to a very small shop?

Yes. PCI DSS applies to any business that accepts payment cards, whatever its size. What changes with size and setup is how you validate. Many small shops complete a short SAQ once a year, and some all-in-one platforms state that their sellers do not need to validate individually. Your processor can confirm.

Can customers use the same Wi-Fi as the registers?

They should not. Sharing the internet line and the hardware is fine, but guest devices belong on a separate, isolated network. A customer’s phone you know nothing about should never be able to reach a register, a card terminal, or the office PC.

Is a cloud POS backed up automatically?

The vendor protects its own servers, which covers hardware failure in your shop. It does not give you an independent copy. Exporting inventory, customer, and sales reports on a schedule means you still have your records if an account is locked, closed, or changed by mistake.

Who should own the online store and domain logins?

The business owner. Staff, designers, and IT providers can have their own delegated logins with the permissions they need. That way access can be removed for one person without handing over or resetting the master account.

How Coastal Growth Co. Can Help

We can map your shop’s network, separate payment devices from guest, camera, and smart-device traffic, tidy up staff accounts before a busy season, and document the result. Scope and price are agreed before work begins. Our retail and point-of-sale page describes the service, and you can reach us through the contact page.