Guides to the PCI DSS SAQs: choosing the right SAQ, eligibility for SAQ A-EP, B, B-IP, C, C-VT and D, the service provider SAQ, and how to complete the questionnaire and its Attestation of Compliance.
How to pick the SAQ that matches how you accept cards: the payment channel each SAQ covers, why every eligibility criterion must be met, how encrypted storage pushes you to SAQ D, multiple channels, and confirming the choice with your acquirer.
When an e-commerce site that does not receive card data still falls under SAQ A-EP: direct post versus iframe and redirect, the eligibility criteria, the requirements v4 added for A-EP merchants, and the payment page script controls that apply.
Which in-store merchants qualify for SAQ B (imprint machines and dial-out terminals) or SAQ B-IP (IP-connected PTS terminals): eligibility, the exclusion of secure card readers, wireless terminals, network isolation and what the v4 SAQs added.
Who can use SAQ C: merchants with a payment application and Internet connection on one device or single-store LAN, isolation from other systems, the requirements v4 added, and when a multi-store or storing environment moves to SAQ D.
When keying card payments into a provider's web-based virtual terminal qualifies for SAQ C-VT: the isolated computer requirement, no card readers or storing software, no other electronic channels, how it differs from SAQ C and the v4.0.1 eligibility update.
What SAQ D for Merchants covers and who must use it: e-commerce sites that accept card data directly, any electronic storage including encrypted data, environments that exceed other SAQs, requirements that can be marked not applicable, and the customized approach limit.
Why SAQ D for Service Providers is the only SAQ a service provider can use, what it adds over merchant SAQs, service-provider-only requirements, Visa's Level 2 threshold, and why a merchant SAQ or AOC is not acceptable evidence for customers.
The mechanics of a self-assessment: the steps from choosing the SAQ to submitting it, performing the Expected Testing, each response option and its appendix, legal exceptions, QSA or ISA help, and signing the Attestation of Compliance.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.