Level-3 E-commerce Dillema

[3Dmerchant]

Pru- I agree with JB. If you have an existing store, no one is going to come looking, though that does not diminish the merchant obligation.
If you want to add a new store, you'll have to prove compliance. I've already been experiencing this for at least 3 months in boarding new client ecommerce merchant accounts.

"shopping cart, gateway and back end order management aspects under a PCI-compliant umbrella"
What's your definition of a small business? A very small business could simply get a yahoo, ebay, or paypal store for an instant compliant solution. In my opinion as a developer and ecommerce store owner over the years, Volusion gives a lot of bang for the buck. I have four years client experience with them and the pros outweigh the cons. It's my favorite and I still own a store hosted there because every time I look around, the others don't fit my needs. The exception might be Magento-, a newer open source cart which recently qualified as compliant if certain rules followed. I've created a store with that as well and which is best depends on client needs.

There are only two gateways I personally recommend for smaller businesses- Authorize.net and Orbital, the latter of which is not as widely integrated.