| SAQ | Who uses it | Penetration test required? | What it asks for |
|---|---|---|---|
| SAQ D Service Provider | Businesses that store, process or transmit card data for other businesses | Yes | Internal and external testing every 12 months, retesting, and segmentation testing every 6 months (11.4.1 to 11.4.6; 11.4.7 for multi-tenant providers) |
| SAQ D Merchant | Merchants that store card data or do not fit another SAQ | Yes | Internal and external testing every 12 months, retesting, and segmentation testing if used (11.4.1 to 11.4.5) |
| SAQ A-EP | Ecommerce sites whose own pages affect the payment form | Yes | External penetration testing every 12 months, plus retesting |
| SAQ C | Payment application on a system connected to the internet | When segmentation reduces scope | Segmentation testing every 12 months (11.4.5) |
| SAQ B-IP | Standalone payment terminals connected over IP | When segmentation reduces scope | Segmentation testing every 12 months (11.4.5) |
| SAQ A | Ecommerce fully outsourced to a PCI compliant processor | No | Quarterly ASV scans are still required (11.3.2) |
| SAQ B | Imprint machines or standalone dial-out terminals | No | None |
| SAQ C-VT | Virtual terminal on one isolated computer | No | None |
| SAQ P2PE | PCI listed point-to-point encryption terminals only | No | None |
| SAQ SPoC | Software-based PIN entry on a phone or tablet | No | None |
Not sure which SAQ you file?
Your acquiring bank or payment processor tells you which SAQ to complete. If you buy PCI ASV scanning from Clone Systems, your SAQ type is in your portal.