Merchants and IT security teams can eliminate confusion during compliance reporting with our streamlined PCI DSS SAQ selector. By answering straightforward questions about how your business processes, stores, and transmits credit card data, you can instantly identify which Self-Assessment Questionnaire (such as A, A-EP, or D) applies to your environment. This provides a clear checklist of required evidence to satisfy your acquiring bank.
SAQ A is for e-commerce merchants who fully outsource all cardholder data functions to PCI-compliant third parties, using iframes or URL redirects. SAQ A-EP applies when merchants outsource payment processing but control the website that dictates how data is transmitted, meaning their site could impact security.
SAQ D is the most comprehensive questionnaire. It applies to merchants who do not meet the strict criteria of any other SAQ type, as well as to all eligible service providers.
No, SAQ B-IP is specifically for merchants using standalone, PTS-approved payment terminals with an IP connection to the payment processor. It does not apply to e-commerce environments.
Merchants are typically required to complete and submit a Self-Assessment Questionnaire, along with an Attestation of Compliance (AOC), on an annual basis to their acquiring bank or payment processor.
No, PCI compliance is a baseline of security standards. While it significantly reduces risk, continuous security monitoring and adherence to best practices are required to protect against evolving threats.