PCI-DSS SAQ Types: Choosing the Right Self-Assessment Questionnaire

What an SAQ Is and When It Applies

The Self-Assessment Questionnaire is a validation tool that merchants use to confirm their compliance with PCI-DSS requirements applicable to their payment environment. It is the primary compliance validation mechanism for merchant levels 2 through 4 — organizations processing below the volume threshold that requires a full Qualified Security Assessor (QSA) on-site assessment. SAQ completion results in an Attestation of Compliance (AOC) submitted to the merchant’s acquirer.
The SAQ process requires honest self-evaluation — not just checking boxes. An organization that completes SAQ A when its actual payment environment qualifies for SAQ A-EP or SAQ D does not achieve compliance by filing the simpler form; it creates liability exposure. Card brands and acquirers investigate the SAQ completed at the time of a breach, and a mismatch between the SAQ filed and the actual environment is treated as evidence of inadequate compliance management. SAQ eligibility is determined by the payment channel and technical architecture, not by preference. For merchant-level context that determines whether an SAQ or a QSA assessment applies, see PCI-DSS merchant levels.

The Eight SAQ Types Under PCI-DSS 4.0

The SAQ A vs. SAQ A-EP Distinction: The Most Common Error

The most consequential SAQ selection error in e-commerce environments is filing SAQ A when SAQ A-EP applies. The distinction turns on one question: does the merchant’s website or application affect the security of the payment transaction?
SAQ A eligibility requires that all cardholder data functions — processing, storage, and transmission — are fully outsourced to a PCI-DSS-validated third party, and that the merchant’s systems have no electronic storage of cardholder data and no impact on the security of the payment page. If the merchant’s website loads any script, redirect, iframe, or element that is used in the payment flow — even if the payment processor hosts the underlying transaction — the merchant’s website affects the security of that transaction, and SAQ A-EP applies rather than SAQ A.
PCI-DSS 4.0’s new Requirement 6.4 for payment page script management is directly relevant to this distinction. A merchant’s implementation of content security policy or script inventory to comply with Requirement 6.4 is, itself, evidence that the merchant’s systems affect the payment security flow — which supports SAQ A-EP eligibility rather than SAQ A. Merchants that have implemented any payment page security controls should re-evaluate their SAQ eligibility. See PCI-DSS 4.0 changes for detail on the script management requirement.

SAQ D for Service Providers: An Assessment-Level Commitment

SAQ D for service providers covers the full scope of PCI-DSS requirements and requires responses to approximately 331 questions. For most service provider organizations, completing SAQ D honestly requires the same operational infrastructure as a QSA-assisted assessment: formal policy framework, documented risk assessment, evidence of continuous monitoring, access control lifecycle documentation, and penetration testing. Organizations that attempt SAQ D as a paper exercise without the underlying operational controls create the highest-risk compliance posture — the controls are neither present nor independently validated.
Service providers that store, process, or transmit cardholder data for more than 300,000 American Express transactions annually, or that have been identified by a card brand or acquirer as requiring a Report on Compliance (ROC) rather than an SAQ, must undergo a full QSA assessment regardless of their preference for SAQ D self-assessment. See PCI-DSS merchant levels for the transaction volume thresholds that trigger mandatory QSA involvement.

P2PE-Validated Solutions and SAQ Reduction

Merchants that deploy a PCI SSC-validated Point-to-Point Encryption (P2PE) solution may qualify for SAQ P2PE, a significantly shorter questionnaire that focuses on the physical security of the P2PE hardware and the merchant’s adherence to the solution provider’s implementation guide. P2PE validation reduces scope because cardholder data is encrypted at the point of interaction before it touches any merchant system. Scope reduction through P2PE is legitimate only when using a solution on the PCI SSC’s List of Validated P2PE Solutions — not all encryption solutions qualify.

Armorstack’s Role in SAQ Selection and Completion

Armorstack’s VERITY advisory team conducts payment environment scoping reviews that determine the correct SAQ type before an organization begins self-assessment. The scoping review maps the complete payment acceptance architecture — channels, systems, third-party integrations, data flows, and storage — against the eligibility criteria for each SAQ type and produces a documented scoping determination that the organization can present to its acquirer.
For organizations completing SAQ D or preparing for a full QSA assessment, SENTRY managed detection and response provides the continuous monitoring, log management, and documented alert review required by Requirements 10 and 11. CORE managed IT services maintains the infrastructure controls — MFA, patch management, firewall configuration, access control — that SAQ D and QSA assessments evaluate in depth. For a broader view of the compliance program, see PCI-DSS compliance. To discuss your payment environment and determine the correct SAQ type, talk to an Armorstack compliance expert or start the 90-Day Proof.