PCI SAQ B is for merchants who process cardholder data using slip machines or standalone dial up terminals. These merchants can process traction with or without a card but not store card data in their system.

PCI SAQ is for merchants or service providers who process less than six million transactions annually.

What are the types of PCI SAQ?

There are nine types of PCI SAQ. These are SAQ A, SAQ A-EP, SAQ B, SAQ B-IP, SAQ C-VT, SAQ C, SAQ P2PE-HW, and SAQ D.

What’s new in PCI DSS v4.0 SAQs?

The PCI DSS v4.0 SAQs have been revised to offer clearer guidance, updated requirements, and enhanced resources for completing the self-assessment. Changes reflect PCI DSS v4.0 updates, with SAQ requirements now mirroring the standard’s wording and aligning reporting responses with the PCI DSS v4.0 Report on Compliance Template.

Why do some PCI DSS requirements in SAQs have multiple response checkboxes?

Some PCI DSS requirements in SAQs have multiple checkboxes for each bullet point to ensure thorough testing of each part, especially for newer or more complex requirements. This approach highlights that each bullet needs separate consideration and a specific testing method.

What does SAQ stand for? How long should an SAQ be?

In PCI DSS, SAQ stands for self assessment questionnaire. The length of a SAQ varies based on the type of payment channel.

Can you fall into two different PCI SAQ types?

Yes. If a business uses multiple payment channels, such as e-commerce and physical terminals, different parts of the environment may match different SAQ types. In such cases, the merchant should confirm with its acquirer or payment brand whether to complete multiple SAQs or use SAQ D for broader coverage.

Which PCI SAQ type do I need?

Your PCI SAQ type depends on how your business accepts payments and whether you store, process, or transmit cardholder data. For example, SAQ A fits fully outsourced card-not-present payments, while SAQ D applies when other SAQ types do not cover your environment.

PCI DSS Archives

PCI SAQ: Types, Requirements, and Applicability Worksheet

Blogs, PCI DSS

PCI SAQ: Types, Requirements, & Applicability Worksheet

TL,DR: PCI SAQ lets eligible merchants self-assess PCI DSS compliance without a full ROC. The right SAQ depends on how you store, process, transmit, or outsource cardholder data. The article explains SAQ types, eligibility rules, payment channels, and truthful response practices. If you are a merchant or service provider who manages, transmits, stores, or accesses…

Blogs, PCI DSS

PCI DSS Assessment: A Quick Guide

For first-timers, preparing for a PCI DSS assessment can feel intimidating. There’s a sense of ambiguity on where to begin, multiple requirements to absorb, and implementation gaps to fill. The larger goal is not just to get compliant but to safeguard cardholder’s data from security threats. A PCI compliance assessment, however, acts as a crucial…

Blogs, PCI DSS

8 Steps to Get PCI Compliance for Small Business

The Payment Card Industry Data Security Standards (PCI DSS) is a compliance framework that sets guidelines for any organization processing card transactions to ensure the protection of sensitive cardholder information. However, with four distinct levels of PCI DSS and the need to interpret and map requirements to specific controls, achieving compliance can be an intensive…

Blogs, PCI DSS

PCI Vulnerability Scan: A Complete Compliance Guide

TL,DR: A PCI vulnerability scan is an automated test identifying potential network vulnerabilities. PCI DSS requires all organizations to conduct both internal and external scans at least quarterly and after substantial network changes External scans must be performed by a PCI SSC Approved Scanning Vendor (ASV) covering public-facing systems. Internal scans focus on hosts, servers,…

Blogs, PCI DSS

PCI QSA Certification: How to get PCI QSA Certification?

Maintaining the security of financial transactions is a top priority for businesses. The PCI SSC has established various Data Security Standards (PCI DSS) to protect cardholder data. But how do organizations ensure that they are PCI DSS compliant? We’ve simplified it for you here. Who is a PCI QSA? The Payment Card Industry Qualified Security…

Blogs, PCI DSS

What is PCI DSS Scope? (How to Create One)

TL,DR: PCI DSS scope covers all processes, people, and technologies that interact with cardholder data (CHD) or impact its security, and every in-scope component must meet all 12 PCI DSS requirements Scope falls into 3 categories: in-scope systems (directly handle CHD), connected-to systems (network access to CDE but no CHD processing), and out-of-scope systems (fully…