Before you decide to be condescending, you should probably freshen up yourself. The vast majority of merchants fall into PCI-DSS Level 2-4. Those merchants com

Before you decide to be condescending, you should probably freshen up yourself. The vast majority of merchants fall into PCI-DSS Level 2-4. Those merchants complete a self-assessment questionnaire (SAQ), in other words, self-reporting. They also have to pass a rather rudimentary quarterly automated scan from an approved vendor. You don't get to external auditors until you get to Level 1, which is a vanishingly small percentage of the merchants in the world.