My processor handles the card. Why do I need a penetration test?

On SAQ A-EP your website still controls how the payment form reaches the customer. If your site is compromised, card data can be captured before it reaches the processor, so PCI DSS requires testing your site.

What is the difference between SAQ A and SAQ A-EP?

SAQ A sites fully hand off payment to the processor with a redirect or iframe and cannot affect the payment page. SAQ A-EP sites can affect it, so many more requirements apply, including penetration testing.

Does an automated penetration test count for SAQ A-EP?

Many assessors accept automated penetration test reports for SAQ A-EP websites. If yours requires an engineer-led test, Clone Systems engineers can perform it.

How fast can I get it done?

The automated external test can be bought online and started the same day, with a 30 day window to test and retest.

Does SAQ A-EP Require a Penetration Test? Yes. Here Is What 11.4 Asks

Does SAQ A-EP require a penetration test?

PCI DSS v4.0.1. Last reviewed October 2026.

Yes. Ecommerce merchants that validate with SAQ A-EP must complete external penetration testing at least every 12 months and after any significant change, under PCI DSS v4.0.1 Requirement 11.4. The test covers the website and systems that control how the payment form reaches your customers, even though a third party processes the card.

What SAQ A-EP asks for

Requirement	In plain language	How often
11.4.1	A documented testing methodology covering the systems that affect your payment page, at both the network and application layer	Kept current
11.4.3	External penetration test of your website and the systems that serve the payment page	Every 12 months and after significant changes
11.4.4	Fix exploitable findings and retest to prove the fix	After each test
11.4.5	Test segmentation controls, if you use segmentation to reduce scope	Every 12 months and after changes

Why SAQ A-EP sites are in scope

On SAQ A-EP, your own website delivers or influences the payment form, for example with a direct post form or JavaScript that loads the processor's fields. If an attacker changes your page, they can capture card numbers before they reach the processor. The penetration test checks that your web servers, content management system and scripts cannot be used that way.

What your assessor or acquirer will look for

The methodology document.
Scope listing the website, web servers and any system that can change the payment page.
The report, with proof for each finding.
Evidence of retesting.
Who performed the test and their qualifications.

How Clone Systems covers SAQ A-EP

Automated external penetration test

From $1,995 for a 30 day testing window, including authenticated web application testing. Covers 11.4.3. Buy online and start the same day.

Engineer-led web application penetration test

For custom checkouts, APIs and complex sites, with a written report and free retest.

Quarterly PCI ASV scanning

SAQ A-EP also requires passing quarterly external ASV scans of the same site (11.3.2), from $185 a year.

Retesting is included with every test, which covers 11.4.4.

Who runs your test

Clone Systems penetration testers hold CISSP, CMMC Certified Professional (CCP), API Penetration Testing (APIsec University), Hack The Box Dante Pro Lab, DevOps for Pentesters (Zero-Point Security), Practical Malware Analysis (TCM Security) and Targeted Malware Reverse Engineering (Kaspersky) credentials, and work alongside PCI ASV qualified staff. Every test is remote; we do not perform on-site testing.

One team for 11.3 and 11.4

Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment.