PCI DSS Self-Assessment Questionnaires (SAQ): Which One Do You Need?

A PCI DSS Self-Assessment Questionnaire (SAQ) is the form eligible merchants and service providers use to validate their compliance with the Payment Card Industry Data Security Standard each year. There are several SAQ types, and the right one depends on how you accept payments and whether card data touches your systems. Choosing the correct SAQ matters: too short and you are not actually compliant, too long and you waste weeks. This guide explains each SAQ, who can use it, and how to complete it.

Related guides: PCI DSS levels · PCI DSS compliance checklist · PCI DSS scoping mistakes · AWS and PCI DSS

Key takeaways

• SAQs are for merchants and service providers not required to submit a Report on Compliance, usually Levels 2 to 4 and service provider Level 2.
• The SAQ type depends on your payment channel and how card data flows.
• SAQ A is the shortest, for fully outsourced card-not-present payments. SAQ D is the full set of requirements.
• Each SAQ comes with an Attestation of Compliance (AOC) that you sign and submit to your acquirer.

---

PCI SAQ types at a glance

SAQ	Who it is for	Card data on your systems?
SAQ A	Card-not-present merchants (e-commerce, mail or phone order) that fully outsource all card data functions to PCI DSS compliant third parties, such as hosted payment pages or iframes	No
SAQ A-EP	E-commerce merchants that outsource payment processing but whose website controls how card data reaches the processor, such as direct post or JavaScript forms	No storage, but the website can affect security
SAQ B	Merchants using only imprint machines or standalone dial-out terminals	No electronic storage
SAQ B-IP	Merchants using only standalone, PTS-approved payment terminals with an IP connection to the processor	No electronic storage
SAQ C-VT	Merchants that key transactions one at a time into a virtual terminal on a web browser, from an isolated computer	No electronic storage
SAQ C	Merchants with payment application systems connected to the internet, without electronic storage of card data	No electronic storage
SAQ P2PE	Merchants using only hardware terminals in a validated point-to-point encryption (P2PE) solution	No
SAQ D for merchants	All merchants not eligible for another SAQ, including those that store card data electronically	Possibly
SAQ D for service providers	Service providers eligible to self-assess	Possibly

How to choose the right SAQ

1. Map your payment channels. List every way you accept cards: website, app, phone, in person.
2. Draw the card data flow for each channel. Where is card data entered, where does it go, and which of your systems touch it?
3. Check the eligibility criteria at the start of each SAQ. You must meet every criterion.
4. If you have several channels, you may need to cover all of them. Your acquirer may accept multiple SAQs or require SAQ D.
5. Confirm with your acquirer or payment processor before you start.

SAQ A vs SAQ A-EP

The difference is whether your website can affect the security of the payment page. With SAQ A, the payment page or form comes entirely from the processor, through a redirect or an iframe. With SAQ A-EP, your website creates the payment form or sends card data directly to the processor, so a compromise of your site could capture card numbers. That is why SAQ A-EP includes many more requirements. In PCI DSS v4.0.1, SAQ A also includes eligibility criteria about protecting the merchant's site from script-based attacks, so read the current version carefully.

How to complete an SAQ

1. Download the current SAQ from the PCI Security Standards Council.
2. Confirm eligibility and document your card data flows.
3. Answer each requirement: in place, in place with a customized approach or compensating control, not applicable, or not in place.
4. Fix gaps before signing, or record them with a remediation plan if your acquirer accepts that.
5. Run quarterly ASV scans if the SAQ requires them.
6. Complete and sign the AOC, and submit it with any required evidence to your acquirer.
7. Repeat yearly and when your payment setup changes.

Common SAQ mistakes

• Choosing SAQ A when your website actually hosts the payment form
• Forgetting a payment channel, such as phone orders taken by support staff
• Storing card numbers in email, support tickets or call recordings
• Treating the SAQ as a form to fill in rather than a check of real controls
• Not updating the SAQ after changing payment providers or checkout flows

Which SAQ fits common setups?

Setup	Likely SAQ
SaaS company charges subscriptions through a processor's hosted checkout page	SAQ A
Online store embeds the processor's payment iframe on its checkout page	SAQ A
Online store uses a JavaScript form on its own page that posts card data directly to the processor	SAQ A-EP
Small shop uses a standalone card terminal connected to the internet	SAQ B-IP
Clinic staff key card details from phone calls into the processor's web-based virtual terminal on one dedicated computer	SAQ C-VT
Restaurant uses a validated P2PE terminal solution	SAQ P2PE
Business stores card numbers to charge customers later on its own systems	SAQ D for merchants
Platform stores or processes card data on behalf of its customers	SAQ D for service providers or a ROC

Your acquirer has the final say, so confirm before you start.

How long does an SAQ take?

SAQ A can take a few hours once you have confirmed eligibility and documented your payment flow. SAQ A-EP and SAQ C usually take days to weeks, because they cover more technical controls such as vulnerability management, logging and secure configuration. SAQ D is the full standard and often takes several weeks of work, especially the first time. Shared controls from SOC 2 or ISO 27001 shorten this considerably.

SAQ vs Report on Compliance

	SAQ	ROC
Completed by	The merchant or service provider	A QSA, or a qualified internal auditor where allowed
Who must use it	Eligible Level 2 to 4 merchants and Level 2 service providers	Level 1 merchants and Level 1 service providers
Depth	Self-attested answers	Detailed testing and evidence review
Cost	Low, mostly internal time	Higher, assessor fees

How SecureSlate helps

SecureSlate helps you scope your cardholder data environment, choose the right SAQ, map PCI DSS requirements to shared controls you already run for SOC 2 or ISO 27001, track ASV scans and keep evidence ready for your acquirer.

FAQ

What is the shortest PCI SAQ?

SAQ A, for card-not-present merchants that fully outsource all card data functions to PCI DSS compliant providers.

Who submits the SAQ?

The merchant or service provider completes and signs it, usually an officer of the company, and submits it with the AOC to the acquirer or as requested by customers or card brands.

Do we need ASV scans with SAQ A?

Requirements change between versions, so check the current SAQ A. Many other SAQs, such as A-EP, B-IP, C and D, require quarterly external ASV scans.

Which SAQ does a SaaS company need?

For charging its own customers through a hosted checkout, usually SAQ A. If it handles card data for customers as a service provider, SAQ D for service providers or a ROC.

How often must an SAQ be completed?

At least once a year, and whenever your payment processes change significantly.

---

Can we use a customized approach in an SAQ?

The customized approach in PCI DSS v4.0 is mainly intended for entities validating with a ROC. SAQ users generally follow the defined approach and may use compensating controls where allowed.

What happens if we choose the wrong SAQ?

You may not actually be compliant, which matters most after a breach. Acquirers and card brands can reject the validation, and you may face fees or a requirement for a fuller assessment.

Can we answer "not applicable" to requirements?

Yes, where a requirement truly does not apply to your environment, but you must explain why. Many SAQs ask for a short justification for each not applicable answer.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory, or professional advice. Requirements vary by framework, industry, and jurisdiction. Consult qualified advisors for your specific obligations.