Which PCI DSS Assessment do I need to perform?
As businesses increasingly rely on electronic payments, safeguarding sensitive payment card data is more critical than ever. The Payment Card Industry Data Security Standard (PCI DSS) provides a set of security standards designed to protect this data. Compliance with PCI DSS is mandatory for any organization that handles payment card data, and depending on the type and size of the business, different types of assessments are required. However, navigating the various types of PCI DSS assessments can be daunting. This article demystifies the different options for your PCI DSS and helps you determine which one is right for your organization.
What is PCI DSS?
The PCI DSS is a set of security standards created by major credit card companies to ensure that all companies that process, store, or transmit credit card information maintain a secure environment. “SAQ” refers to “Self-Assessment Questionnaire.”
Types of PCI DSS SAQ Assessments
1. SAQ-A: For Online or Mail/phone Order Businesses that Fully Outsource Payment Processing
This is the simplest and least demanding assessment. SAQ-A is intended for merchants who do not store, process, or transmit any cardholder data on their premises. Typically, these are e-commerce merchants who fully outsource their payment processing to third-party service providers. They don’t handle card data directly, making this the easiest and shortest questionnaire.
2. SAQ-B: For Merchants Using Imprint Machines or Standalone Payment Terminals
SAQ-B is for merchants who process payments using non-connected, standalone payment terminals (such as dial-out terminals) with no electronic storage of cardholder data. This SAQ ensures that basic security practices are followed, but it is only suitable for environments with minimal exposure to cardholder data.
3. SAQ-C: For Merchants with Payment Application Systems Connected to the Internet
SAQ-C applies to merchants with payment applications connected to the Internet but who do not store cardholder data electronically. This SAQ is suitable for small to medium-sized businesses that have payment systems connected to the Internet but rely on a PCI DSS compliant payment service provider to manage the processing.
4. SAQ-C-VT: For Merchants Using Virtual Terminals Only
If your business uses a virtual terminal accessed through an Internet-connected web browser and there is no electronic storage of cardholder data, SAQ-C-VT is the right choice. This SAQ is designed for merchants who process card payments one at a time using a computer but do not process large volumes or store any data.
5. SAQ-D: For All Other Merchants and Service Providers
SAQ-D is the most comprehensive and is used by merchants and service providers that don’t fit into any of the other SAQ categories. This includes organizations that store cardholder data or those with more complex payment environments. SAQ-D is significantly longer and more detailed, reflecting the broader scope of security requirements applicable to these entities.
Examples: Determining Which SAQ to Use
- E-commerce or mail/telephone order merchants: If you fully outsource your payment processing, use SAQ-A.
- Brick-and-mortar stores with standalone terminals: SAQ-B is likely the best fit if you use dial-out terminals.
- Merchants with internet-connected payment systems: Consider SAQ-C if you don’t store data or SAQ-C-VT if using a virtual terminal.
- Businesses storing cardholder data or with complex environments: SAQ-D is necessary.
How to Determine If You Need an SAQ or ROC
Another key decision point is whether your organization needs a PCI DSS Report On Compliance (ROC) and/or the SAQ. ROCs are not segmented by the type/structure of the business as are SAQs as discussed above. Instead, the ROC is a comprehensive assessment to document an organization’s compliance with the full set of PCI DSS requirements based primarily on the volume of transactions processed. Smaller merchants/service providers with a straightforward payment process might only need the SAQ; however, larger organizations with higher transaction volumes or complex payment environments will likely need to complete a ROC.
If you require a ROC, the scope and content of the ROC are tailored to the specific environment of the organization being assessed:
1. Merchant Transaction Processing Levels:
- The card brands (i.e., Visa, MasterCard, American Express, etc.) categorize merchants into different levels based on their annual transaction volume. Level 1 merchants, who process the most transactions, usually require a ROC, while lower-level merchants may only need to complete an SAQ.
Level | Merchant Type | Annual Transaction Volume | Requirements |
Level 1 | Large merchants | Over 6 million transactions | Most stringent requirements |
Level 2 | Mid-sized merchants | 1 to 6 million transactions | Moderate requirements |
Level 3 | Smaller e-commerce merchants | 20,000 to 1 million transactions | SAQ focus |
Level 4 | Smallest merchants | Under 20,000 e-commerce or under 1 million overall transactions | Minimal requirements |
2. Consult with Your Acquiring Bank:
- If your payment environment is simple (e.g., you don’t store cardholder data and use third-party processors), a SAQ may be sufficient.
- If your environment is complex (e.g., you store cardholder data or have a multi-channel payment process), a ROC might be necessary.
- Your acquiring bank will provide guidance on whether you need to submit a SAQ or a ROC based on your transaction volume and risk profile.
3. Incident History
- If your organization has experienced a data breach or security incident, you might be required to complete a ROC, regardless of your transaction volume.
4. Service Provider Request
- For service providers, it could depend on your clients. Some large customers might request a ROC or third-party review.
Consult with the AARC-360 team and we are happy to discuss your organization and the PCI requirements to ensure you are meeting all the correct compliance requirements.
Mihika Madhavan (Client Relations and Project Management Associate, AARC-360)
