How assessments work

Before we ask about payment channels, we confirm you are actually eligible to self-assess. Any of the following routes you to a QSA-led Report on Compliance instead of an SAQ:

• Level 1 merchant (>6M Visa/Mastercard transactions/yr or brand-designated).
• Level 1 service provider (>300k transactions/yr) — SAQ D-SP is Level 2 only.
• Acquirer or payment brand has mandated a Report on Compliance.
• Designated Entity subject to PCI DSS Appendix A3 (DESV).
• Confirmed account-data breach in the last 12 months with acquirer escalation.

Source: PCI DSS v4.0.1 §4 Assessment Process; Visa/Mastercard validation levels.

If you clear triage, we confirm the short-form baseline: no electronic storage of account data, no DESV designation, no ROC mandate, no recent breach. If any fails, you route to SAQ D-Merchant (or QSA if the failure is severe).

• No electronic storage of PAN, cardholder name, service code, expiry, or SAD.
• Not a Designated Entity (Appendix A3).
• No ROC mandated by acquirer / payment brand.
• No unresolved confirmed breach in the last 12 months.

Source: SAQ Instructions & Guidelines v4.0.1 r1, Eligibility (short-form SAQs).

You pick the payment channel (e-commerce, MOTO, card-present) and the acceptance method. If you accept multiple channels, every channel must independently qualify for the SAME SAQ or SAQ D-Merchant applies — we ask you to answer for the weakest-scope channel.

• E-commerce: page origin decides SAQ A vs A-EP vs D.
• MOTO / Card-present: acceptance method decides SAQ A, B, B-IP, C, C-VT, P2PE, SPoC, or D.
• Multi-channel: the weakest channel sets the SAQ.

Source: PCI DSS Self-Assessment Questionnaire Instructions and Guidelines, "Which SAQ Best Applies to My Environment?" chart.

For the candidate SAQ we present the official eligibility clauses verbatim. Every item is ticked by default; untick any that is not true for your environment. A single unticked clause fails-closed to the next strictest SAQ (usually D-Merchant). We never round up to a looser SAQ.

• SAQ A — 7 clauses (fully outsourced e-commerce).
• SAQ A-EP — 8 clauses (partially outsourced e-commerce affecting payment page).
• SAQ B / B-IP / C / C-VT / P2PE / SPoC — official clauses from the front of each SAQ.
• SAQ D-Merchant / D-SP — the catch-all when nothing shorter applies.

Source: Front matter of each individual PCI SSC SAQ v4.0.1.

Every question, answer, and unticked clause is written to a signed trace stored with your assessment and printed on the generated SAQ/AoC PDF. Before you start the SAQ we ask you to formally attest to the eligibility clauses. This gives you (and your acquirer) a defensible record of why that SAQ was chosen.

• Full decision path stored as selector_trace on the assessment.
• Attestation of eligibility clauses stored with the assessment.
• ‘SAQ Selection Rationale’ section rendered into the final PDF.

Source: PCI Assessments Center audit trail.