Free Assessment

Which SAQ Am I?

Answer a few quick questions to find out which PCI DSS Self-Assessment Questionnaire applies to your business.

Question 1

Do your own systems store, process, or transmit full credit card numbers (PAN)?

This covers more than storage. If card data is saved in your database or logs, passes through your application or server, or is relayed by you to your payment processor, the answer is Yes.

Question 2

How do you accept payments? (Select all that apply)

Question 3 E-commerce Channel

How do customers enter their card details on your website?

Question 3 Retail / In-Person Channel

What kind of payment machine do you use?

Question 3 Mail / Telephone Channel

How do you process the card data you receive over the phone or mail?

Question 4

Does any single system, application, piece of paper or database that you operate store or process card data from more than one of your payment channels?

If both channels are fully outsourced to different payment service providers and card data never passes through systems or records you control, the answer is No.

SAQ A

The simplest compliance level for e-commerce

What this means for you:

  • Approximately 27 requirements to meet
  • Quarterly external vulnerability scans (ASV) required
  • Focus on policies, access control, and vendor management
  • Annual self-assessment questionnaire
Get My SAQ A Dashboard

This result is a recommendation based on your inputs. Confirm your SAQ type with your acquiring bank or payment processor.

SAQ A-EP

E-commerce with direct data handling

What this means for you:

  • Approximately 139 requirements to meet
  • Quarterly vulnerability scans required (ASV)
  • Penetration testing may be required
  • Significantly higher security obligations than SAQ A
See My Compliance Roadmap We break down 139 requirements into manageable tasks

This result is a recommendation based on your inputs. Confirm your SAQ type with your acquiring bank or payment processor.

SAQ B

Standalone dial-up terminals

What this means for you:

  • Approximately 28 requirements to meet
  • No vulnerability scans required
  • Focus on physical security and terminal management
  • One of the simpler retail SAQ types
Get My SAQ B Dashboard

This result is a recommendation based on your inputs. Confirm your SAQ type with your acquiring bank or payment processor.

SAQ B-IP

Standalone IP-connected terminals

What this means for you:

  • Approximately 50 requirements to meet
  • Quarterly vulnerability scans required (ASV)
  • Focus on network segmentation and terminal security
  • More requirements than SAQ B due to internet connectivity
Get My SAQ B-IP Dashboard

This result is a recommendation based on your inputs. Confirm your SAQ type with your acquiring bank or payment processor.

SAQ C

Payment application systems

What this means for you:

  • Approximately 122 requirements to meet
  • Quarterly vulnerability scans required (ASV)
  • Focus on POS system security and network controls
Get My SAQ C Dashboard

This result is a recommendation based on your inputs. Confirm your SAQ type with your acquiring bank or payment processor.

SAQ C-VT

Virtual terminal only

What this means for you:

  • Approximately 54 requirements to meet
  • No vulnerability scans required
  • Focus on workstation security and access controls
  • Your virtual terminal must be provided by a PCI-compliant processor
Get My SAQ C-VT Dashboard

This result is a recommendation based on your inputs. Confirm your SAQ type with your acquiring bank or payment processor.

SAQ D

Full PCI DSS validation required

What this means for you:

  • Approximately 250 requirements to meet
  • Quarterly vulnerability scans required (ASV)
  • Annual penetration testing required
  • Most comprehensive and resource-intensive SAQ type
  • Consider working with a QSA (Qualified Security Assessor)
Get My SAQ D Dashboard We help you organize all ~250 requirements

This result is a recommendation based on your inputs. Confirm your SAQ type with your acquiring bank or payment processor.

Multiple SAQs

You can assess each payment channel independently

What this means for you:

  • File a separate SAQ for each payment channel
  • Each channel is assessed independently against its own requirements
  • Total compliance effort equals the sum of each individual SAQ
  • Confirm this approach with your acquiring bank before filing
Start my compliance programme

This result is a recommendation based on your inputs. Confirm your SAQ types with your acquiring bank or payment processor.