Everything you Wanted to Know About PCI SAQ (Self-Assessment Questionnaire)

The growing popularity of card-based and online transactions has certainly been a boon for retail merchants since it has made it extremely convenient for consumers to conduct transactions. Yet, this convenience has come at a cost. With the growth of cashless transactions, we’ve seen a corresponding increase in the number of instances of fraud, identity theft, and other cyber crimes.

To reduce these instances, the PCI SSC has made it mandatory that every merchant or service provider who stores, processes and/or transmits cardholder data (credit, debit, or prepaid card) needs to be PCI DSS compliant for handling more than 6 million transactions annually. While merchants might view PCI DSS compliance as an unnecessary burden, the truth is that getting compliant is important for the merchant too.

For merchants and service providers that handle less than 6 million transactions annually, PCI DSS offers the option of Self-Assessment Questionnaires (PCI SAQ). This is a self-validation questionnaire to assess if the business meets the compliance guidelines. This ensures the security of your business and cardholders data. It also helps build the trust with customers since you are giving them the confidence that you are looking out for them. Customer confidence is a key aspect of building long-term relationships.

Types of PCI SAQs and applicability

Below are the 9 types of PCI SAQs available. You need to choose (or SISA will help you to choose) the right one based on your particular payment and transaction scenario.

1. SAQ A
   For merchants, who handle card-not-present transactions (excluding face to face channels) and outsource all the payment processing to PCI DSS validated third parties service providers.

2. SAQ A-EP
   Applicable only for E-Commerce channels, with websites that do not get sensitive data directly and has outsourced all the payment processing third-party service providers.

3. SAQ B
   This is for merchants that use various types of standalone, dial-out terminals, and imprint machines that do not have electronic cardholder data storage.

4. SAQ B-IP
   This is applicable for merchants that use standalone, PTS-approved payment terminals with an IP connection to the payment processor and no storage for CHD.

5. SAQ C
   For merchants with payment application systems with an internet connection and no electronic cardholder data storage.

6. SAQ C-VT
   For merchants that enter the data of each transaction manually into virtual internet-based virtual terminal solutions provided by a PCI DSS validated third-party service provider.

7. SAQ P2PE-HW
   For merchants using only PCI SSC-listed P2PE solution validated hardware payment terminals with no electronic cardholder data storage.

8. SAQ D for Merchants
   All merchants that were not covered in the above list must go for SAQ.

9. SAQ D for Service Providers
   When a Payment Card Brand defines a service provider, then it is eligible for Self-Assessment Questionnaire.

Once you identify the right self-assessment questionnaire for you, the next step is to download and fill it out against each question. The questionnaire needs to be filled out every year as mandated by PCI SSC. It is a simple Yes/No questionnaire. If you answer No to any of the questions, you need to take additional steps to become compliant. Once you have completed the compliance requirements, an Attestation of Compliance needs to be completed.

Getting Started on Self-Assessment Questionnaire?

Given the importance of choosing the right questionnaire and also ensuing that it is completed accurately, it often makes sense to work with a qualified QSA that can help simplify the self-assessment process. By working with a qualified QSA such as SISA, you can get the required assistance to choose the appropriate SAQ for the company and ensure that the process goes smoothly all the way to the submission of Attestation of Compliance.

At SISA, our approach is to assess risks proactively using an effective information security framework to ensure a better security strategy. In case the current assessment throws up any red flags based on the analysis of different threat vectors, we generally recommend a list of remedial actions to achieve full SAQ compliance.

For any organization, protecting its data should be a top priority. By being proactive about compliance and security, you can secure your information assets effectively. This not only helps you deliver the very best to your clients by ensuring continuous operations, but it also helps preserve client trust and build a strong brand. The PCI SAQ is an important step to achieve compliance and also to bolster your security infrastructure.

Connect with us if you would like any guidance on Self-Assessment Questionnaire (PCI SAQ).