PCI DSS SAQ Types: Which Self-Assessment Questionnaire Applies?
Most smaller merchants validate PCI DSS compliance with a Self-Assessment Questionnaire, or SAQ. The catch is choosing the right one, the type depends entirely on how you accept and process card payments.
Pick the wrong SAQ and you either over-scope (answering controls you do not need) or under-scope (missing controls that apply). Here is how the main types differ.
SAQ A and A-EP (e-commerce)
SAQ A is for merchants who fully outsource cardholder data handling to a compliant third party, your site never touches card data (for example, a fully hosted payment page).
SAQ A-EP applies when your e-commerce site does not receive card data directly but can affect the security of the payment page (for example, a direct-post or iframe integration you control).
SAQ B, B-IP, and C (terminals and apps)
SAQ B covers standalone, dial-out terminals or imprint machines. SAQ B-IP covers standalone IP-connected terminals.
SAQ C is for merchants with payment application systems connected to the internet; SAQ C-VT covers web-based virtual terminals.
SAQ D (everyone else)
SAQ D is the comprehensive questionnaire for merchants that store cardholder data or do not fit the other types, and a separate SAQ D exists for service providers.
It is the largest SAQ because it covers the full set of applicable PCI DSS requirements.
PCI DSS policy templates
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Automate PCI DSS with Thoropass
Thoropass maps the controls, collects evidence automatically, and keeps you audit-ready. Audit plus automation under one roof.
FAQ
- How do I know which SAQ applies?
- It depends on how you accept card payments and whether you store, process, or transmit card data. Your acquirer or a QSA can confirm.
- Which SAQ is the simplest?
- SAQ A, for merchants who fully outsource card handling to a compliant provider, so card data never touches their systems.
- Does using a SAQ avoid a full audit?
- For eligible merchant levels, yes, the SAQ self-attestation replaces a full on-site assessment, but you must complete the correct one honestly.