Which PCI SAQ do I need?
Answer the same eligibility questions an assessor would ask. You will see which self-assessment questionnaire most likely applies, whether it requires a penetration test or ASV scans, and how to complete it.
This tool gives general guidance based on the PCI DSS v4.0.1 SAQ eligibility criteria. Clone Systems is a PCI Approved Scanning Vendor (ASV), not a Qualified Security Assessor (QSA). Your acquiring bank or the payment brands decide which SAQ you must use. Confirm your result with your acquirer or a QSA before you file.
Do you store, process or transmit card data on behalf of other businesses (for example as a payment gateway, processor, hosting provider or managed service provider)?
The ten PCI SAQs at a glance
| SAQ | Who it is for | Pen test required |
|---|---|---|
| SAQ D Service Provider | Businesses that store, process or transmit card data for other businesses | Yes |
| SAQ D Merchant | Merchants that store card data or do not fit another SAQ | Yes |
| SAQ A-EP | Ecommerce sites whose own pages affect the payment form | Yes |
| SAQ C | Payment application on a system connected to the internet | When segmentation reduces scope |
| SAQ B-IP | Standalone payment terminals connected over IP | When segmentation reduces scope |
| SAQ A | Ecommerce fully outsourced to a PCI compliant processor | No |
| SAQ B | Imprint machines or standalone dial-out terminals | No |
| SAQ C-VT | Virtual terminal on one isolated computer | No |
| SAQ P2PE | PCI listed point-to-point encryption terminals only | No |
| SAQ SPoC | Software-based PIN entry on a phone or tablet | No |
FAQ
Who decides which SAQ I use?
Your acquiring bank or the payment brands. This finder gives guidance only.
Is Clone Systems a QSA?
No. Clone Systems is a PCI Approved Scanning Vendor. We perform ASV scans and penetration tests; a QSA or your acquirer confirms your SAQ.
What if I accept cards more than one way?
Each channel may qualify for a different SAQ. Many acquirers then require SAQ D for merchants.