@sean103   If you accept credit cards for ANY amount, you MUST be PCI compliant. 

However, you do NOT have to, nor should you use Security Metrics.  They are extremely expensive, mean, dishonest and bullies.  

There are a large number of other companies out there that you can, and should look into.  

You can also do it yourself, as it would save money.