What SAQ A asks for in Requirement 11
| Requirement | In plain language | How often |
|---|---|---|
| 11.3.2 | External vulnerability scans by a PCI Approved Scanning Vendor, with a passing result | Every 3 months |
| 11.3.2.1 | External scans after any significant change | After significant changes |
| 11.4 | Penetration testing | Not required for SAQ A |
Who qualifies for SAQ A
SAQ A is for ecommerce and mail or phone order merchants that fully outsource card handling to a PCI compliant processor, for example with a redirect or an embedded payment frame, and never store, process or transmit card data themselves. The merchant must also confirm their site is not susceptible to attacks from scripts that could affect the payment process. If your own pages can change how the payment form loads, you likely need SAQ A-EP instead, which does require a penetration test.
How Clone Systems covers SAQ A
PCI ASV scanning
Quarterly external scans by an Approved Scanning Vendor since 2007, with free rescans and guided remediation, from $185 a year. Covers 11.3.2 and 11.3.2.1.
Optional external penetration test
Not required for SAQ A, but often requested by cyber insurers and business customers. Automated external tests from $1,995, bought online and started the same day.