top of page
Writer's pictureDigiwuff
Aug 24, 20213 min read

What is an SAQ and Which SAQ Should Businesses Use for PCI Compliance

Just understanding what a Self Assessment Questionnaire (SAQ) is can be a challenge, let alone understanding which one to fill out and how to answer the questions. Lets take a look at SAQs and how they are used.

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements designed to ensure the safe handling of cardholder data by merchants, service providers, and other organizations involved in processing payment card transactions. To demonstrate compliance with PCI DSS, organizations must complete a Self-Assessment Questionnaire (SAQ) that best matches their specific payment processing environment.


There are multiple SAQ types, each tailored for different business scenarios. The following is a detailed analysis of the differences among the most common SAQs for PCI compliance:


SAQ A

  • Intended for: Card-not-present merchants with fully outsourced e-commerce payment processing, who do not store, process, or transmit cardholder data on their systems.

  • Requirements: Must meet the requirements of PCI DSS applicable to their environment and complete 22 relevant questions.

SAQ A-EP

  • Intended for: E-commerce merchants who partially outsource their payment processing to a PCI DSS validated third-party service provider but control the redirection of customers to the payment processor.

  • Requirements: Must meet the requirements of PCI DSS applicable to their environment and complete 139 relevant questions.

SAQ B

  • Intended for: Merchants with only standalone, dial-out terminals or imprint machines, who do not store cardholder data electronically and do not transmit cardholder data over the internet.

  • Requirements: Must meet the requirements of PCI DSS applicable to their environment and complete 41 relevant questions.

SAQ B-IP

  • Intended for: Merchants with standalone, IP-connected terminals, who do not store cardholder data electronically and have implemented necessary controls for securing their terminals.

  • Requirements: Must meet the requirements of PCI DSS applicable to their environment and complete 83 relevant questions.

SAQ C

  • Intended for: Merchants with a payment application system connected to the internet, who do not store cardholder data electronically.

  • Requirements: Must meet the requirements of PCI DSS applicable to their environment and complete 139 relevant questions.

SAQ C-VT

  • Intended for: Merchants who process cardholder data via a virtual terminal solution provided by a PCI DSS validated third-party service provider.

  • Requirements: Must meet the requirements of PCI DSS applicable to their environment and complete 73 relevant questions.

SAQ P2PE

  • Intended for: Merchants using a validated, PCI-approved Point-to-Point Encryption (P2PE) solution for processing cardholder data.

  • Requirements: Must meet the requirements of PCI DSS applicable to their environment and complete 35 relevant questions.

SAQ D

  • Intended for: All other merchants and service providers not covered by previous SAQ types, including those who store, process, or transmit cardholder data.

  • Requirements: Must meet the requirements of PCI DSS applicable to their environment and complete all 329 questions.

In conclusion, the SAQ types differ primarily based on the organization's payment processing environment and the extent to which cardholder data is handled. Organizations should carefully analyze their specific situation and choose the appropriate SAQ type that best aligns with their business practices.


For additional PCI related information check out these other blog posts!

10 views0 comments

Comments

bottom of page