Restrict Access to Cardholder Data

Merchants you must implement strong access control measures to cardholder data, this is written in requirment 7 of PCI security requirements. If you have several people who have access to card holder data you must have a formal security policy that lays out a statement of least privilege. You can write your own in simple terms that everyone will understand.

Unauthorized access to cardholder data is punishable up to immediate termination. You as a manager must let your staff know this is as serious as losing employment.
Let everyone know fines up to 500,000 dollars can be levied against the company for a breech.

PCI Rules

PCI (Payment Card Industry) has new rules and fee's going into effect in the near future in a effort to make merchants more responsible for protecting card holder data. Fine's to the merchant can go up to 50 thousand dollars. You as a merchant should not be storing card holder account information, if you must use your processors storage through a virtual terminal where you hold data on your processors servers.