Assessments — find your correct PCI validation path

QSA-vs-SAQ triage first, then official PCI SSC eligibility checks. A short-form SAQ is only recommended when every clause is confirmed — otherwise you are routed to SAQ D or a QSA engagement.

Browse all SAQs Which SAQ guide How this works

Question 1

Step 1

First — which best describes your organisation?

We start with a QSA-vs-SAQ triage so you don't spend time on an SAQ path when a Report on Compliance (ROC) is actually required.

Source: PCI DSS v4.0.1 §4 Assessment Process; SAQ Instructions & Guidelines v4.0.1 r1, Eligibility.