What is a Pci Self-assessment Questionnaire (saq)?

A PCI Self-Assessment Questionnaire (SAQ) is a validation tool designed to help merchants and service providers evaluate and report their compliance with the PCI DSS 4.0 security standards. It serves as a manageable compliance path, particularly for small to mid-size businesses, to demonstrate that they have implemented the required security controls to protect cardholder data.

The SAQ is not a one-size-fits-all document; it must be completed annually based on a business’s specific payment processing environment. The common SAQ types include:

• SAQ A: For e‑commerce merchants who completely outsource all cardholder data functions.
• SAQ B: For merchants using standalone, dial‑out terminals.
• SAQ C: For merchants with payment application systems connected to the internet.
• SAQ D: For all other merchants who do not meet the criteria for the types mentioned above.

Correctly identifying and completing the appropriate SAQ is critical because it validates your security posture against requirements like multi-factor authentication, encryption, and firewall deployment. Failing to complete the correct version can lead to validation gaps, penalty fees, or monthly non-compliance fees on merchant statements.

• PCI DSS 4.0 Compliance: Complete Guide for 2026