Free Assessment

Which SAQ Am I?

Answer a few quick questions to find out which PCI DSS Self-Assessment Questionnaire applies to your business.

Question 1

Do you store full credit card numbers (PAN) electronically in your database or logs?

Question 2

How do you accept payments? (Select all that apply)

Question 3 E-commerce Channel

How do customers enter their card details on your website?

Question 3 Retail / In-Person Channel

What kind of payment machine do you use?

Question 3 Mail / Telephone Channel

How do you process the card data you receive over the phone or mail?

Question 4

Does any single system, application, piece of paper or database that you operate store or process card data from more than one of your payment channels?

If both channels are fully outsourced to different payment service providers and card data never passes through systems or records you control, the answer is No.

SAQ A

The simplest compliance level for e-commerce

What this means for you:

  • Approximately 22 requirements to meet
  • No vulnerability scans required
  • Focus on policies, access control, and vendor management
  • Annual self-assessment questionnaire
Get My SAQ A Dashboard

This result is a recommendation based on your inputs. Confirm your SAQ type with your acquiring bank or payment processor.

SAQ A-EP

E-commerce with direct data handling

What this means for you:

  • Approximately 191 requirements to meet
  • Quarterly vulnerability scans required (ASV)
  • Penetration testing may be required
  • Significantly higher security obligations than SAQ A
See My Compliance Roadmap We break down 191 requirements into manageable tasks

This result is a recommendation based on your inputs. Confirm your SAQ type with your acquiring bank or payment processor.

SAQ B

Standalone dial-up terminals

What this means for you:

  • Approximately 41 requirements to meet
  • No vulnerability scans required
  • Focus on physical security and terminal management
  • One of the simpler retail SAQ types
Get My SAQ B Dashboard

This result is a recommendation based on your inputs. Confirm your SAQ type with your acquiring bank or payment processor.

SAQ B-IP

Standalone IP-connected terminals

What this means for you:

  • Approximately 82 requirements to meet
  • Quarterly vulnerability scans required (ASV)
  • Focus on network segmentation and terminal security
  • More requirements than SAQ B due to internet connectivity
Get My SAQ B-IP Dashboard

This result is a recommendation based on your inputs. Confirm your SAQ type with your acquiring bank or payment processor.

SAQ C

Payment application systems

What this means for you:

  • Approximately 160 requirements to meet
  • Quarterly vulnerability scans required (ASV)
  • Focus on POS system security and network controls
  • Your payment application must be PA-DSS validated
Get My SAQ C Dashboard

This result is a recommendation based on your inputs. Confirm your SAQ type with your acquiring bank or payment processor.

SAQ C-VT

Virtual terminal only

What this means for you:

  • Approximately 79 requirements to meet
  • No vulnerability scans required
  • Focus on workstation security and access controls
  • Your virtual terminal must be provided by a PCI-compliant processor
Get My SAQ C-VT Dashboard

This result is a recommendation based on your inputs. Confirm your SAQ type with your acquiring bank or payment processor.

SAQ D

Full PCI DSS validation required

What this means for you:

  • All 300+ PCI DSS requirements apply
  • Quarterly vulnerability scans required (ASV)
  • Annual penetration testing required
  • Most comprehensive and resource-intensive SAQ type
  • Consider working with a QSA (Qualified Security Assessor)
Get My SAQ D Dashboard We help you organize all 300+ requirements

This result is a recommendation based on your inputs. Confirm your SAQ type with your acquiring bank or payment processor.

Multiple SAQs

You can assess each payment channel independently

What this means for you:

  • File a separate SAQ for each payment channel
  • Each channel is assessed independently against its own requirements
  • Total compliance effort equals the sum of each individual SAQ
  • Confirm this approach with your acquiring bank before filing
Start my compliance programme

This result is a recommendation based on your inputs. Confirm your SAQ types with your acquiring bank or payment processor.