SAQ (Self-Assessment Questionnaire)

A Self-Assessment Questionnaire is a validation tool for reporting the results of a PCI DSS self-assessment. It is meant for SAQ-eligible merchants and service providers, meaning those not required by an acquirer or payment brand to submit a full Report on Compliance 1. Eligibility depends on the payment brand compliance programs and on the criteria set out in the chosen SAQ 1.

There are several SAQ types, each matched to a payment environment. SAQ A, for example, covers card-not-present merchants that fully outsource account data functions to compliant third parties, while SAQ B covers imprint machines and standalone dial-out terminals 8. SAQ D is for eligible merchants that fit no other type 3. Service providers that may self-assess use only SAQ D for Service Providers 8.

In practice, an agency should:

• Match its payment environment to the SAQ eligibility criteria and confirm it meets all of them before starting 12.
• Not assume an SAQ is unchanged between PCI DSS v3.2.1 and v4.x, and read the current version in full 2.
• Check with its acquirer or the payment brands whether it may use an SAQ at all, and whether they have specific instructions 18.

Which SAQ applies is decided by the agency's actual card handling and by what the acquirer or payment brand requires, not by preference 2.