Does SAQ C-VT require an ASV scan?

No. SAQ C-VT has no Requirement 11 items.

Can staff use the virtual terminal computer for email or browsing?

Using it for other work makes it harder to keep it isolated. If it connects to other systems, SAQ C-VT may no longer apply.

Can I use SAQ C-VT for phone orders?

Yes, if staff type each phone or mail order into the virtual terminal one at a time and do not store the card data electronically.

Who decides which SAQ I use?

Your acquiring bank or the payment brands. Clone Systems is a PCI Approved Scanning Vendor, not a QSA.

Does SAQ C-VT Require a Penetration Test? No. Here Is What It Does Require

Does SAQ C-VT require a penetration test?

PCI DSS v4.0.1. Last reviewed October 2026.

No. SAQ C-VT has no Requirement 11 section, so it does not require a penetration test, internal scans or ASV scans. It is for merchants that type one transaction at a time into a PCI DSS compliant virtual terminal in a web browser, on a computer that is isolated from everything else.

When SAQ C-VT stops applying

If	You likely move to	What that adds
The computer is shared or connected to other systems	SAQ D for merchants	Full penetration testing and scanning
You attach a card reader or use point-of-sale software	SAQ C	Quarterly internal and ASV scans and segmentation testing if used
You add a website that takes payments through a hosted payment page	SAQ A for that channel	Quarterly ASV scans

Who qualifies for SAQ C-VT

The official SAQ C-VT lists these conditions. All must be true for this payment channel:

Your only payment processing is a virtual terminal accessed in a web browser.
The virtual terminal is provided and hosted by a PCI DSS compliant third-party service provider.
The computer used for it is isolated at a single location and not connected to other locations or systems, for example by a firewall or network segmentation.
The computer has no software that stores card data, such as batch processing or store-and-forward.
No card readers or other devices that capture card data are attached.
You do not receive, send or store card data electronically any other way.
Any card data you keep is on paper only and is never received electronically.

SAQ C-VT can apply to in-person and mail or phone order merchants. It does not apply to ecommerce or to service providers.

How Clone Systems can help

PCI SAQ Finder

Confirm SAQ C-VT still fits in a few minutes.

Network vulnerability assessment

Check that the virtual terminal computer really is isolated from the rest of your network.

Penetration testing when someone asks for it

Cyber insurers and business customers often ask for a pen test even when PCI does not. Automated external tests from $1,995.

One team for 11.3 and 11.4

Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment.