Free guide · PCI DSS v4.0.1

SAQ, AoC and ROC — which document is which

The SAQ is the questionnaire you answer, the AoC is the signed declaration of the result, and the ROC is the detailed report a QSA writes when self-assessment is not available. An SAQ is always accompanied by an AoC. A ROC is required for Level 1 merchants and Level 1 service providers, or whenever a brand or acquirer mandates it.

Find your SAQ All guides

Self-Assessment Questionnaire (SAQ)

A PCI SSC validation tool completed by the entity itself, in one of ten v4.0.1 forms.

Which form applies depends on how each payment channel accepts and handles account data.

Every short-form SAQ requires that no account data is stored electronically.

Completing an SAQ for internal readiness is legitimate and useful, but it is not validation on its own.

Attestation of Compliance (AoC)

The signed declaration of the assessment result, naming the entity, the scope and the method used.

Accompanies both self-assessments and QSA-led assessments, on the appropriate form.

This is usually the artefact an acquirer, payment brand or enterprise customer asks to see.

A QSA-signed AoC carries the assessor's validation; a self-signed AoC carries yours.

Report on Compliance (ROC)

The detailed report produced by a QSA, or a qualified ISA where the brand allows, documenting testing for every applicable requirement.

Mandatory for Level 1 merchants and Level 1 service providers, and whenever mandated by a brand or acquirer.

Records scope, sampling, testing performed, results, and any compensating controls or customised approach implementations.

Always accompanied by an AoC.

Which one will you be asked for?

Ask your acquirer — they are the compliance-accepting entity and set the reporting requirement.

If you are eligible to self-assess: the correct SAQ plus its AoC.

If a ROC is mandated, or you are Level 1: a QSA engagement producing a ROC and AoC.

If you need a signed SAQ and AoC without a full ROC, a QSA can validate the self-assessment you have already completed.

Turn the reading into an answer

The free SAQ selector walks the official PCI SSC v4.0.1 decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Written by Haumaru Whānau QSAs. PCI DSS content paraphrased from PCI DSS v4.0.1 and PCI SSC published guidance; payment brand programmes are set by the brands and your acquirer. Independent summary; not endorsed by PCI SSC.