For small businesses the only way to properly set up CC processing is to leave everything to an outside company, the CC data may not be entered at all on your site so you don't end up with having to comply with PCI DSS, the audits and the associated costs.