Which PCI SAQ Do You Actually Need? A Small Merchant’s Guide
If you accept credit cards, you’re subject to PCI DSS — but almost no small merchant needs the full standard. The Self-Assessment Questionnaire (SAQ) you actually need depends entirely on how you process payments, and picking the wrong one either leaves real gaps or saddles you with far more paperwork than your setup requires.
SAQ Types at a Glance
| SAQ type | Who it’s for | Typical setup |
|---|---|---|
| SAQ A | Fully outsourced e-commerce | Hosted checkout page (Stripe Checkout, PayPal, Square Online) — you never touch card data |
| SAQ A-EP | E-commerce with a page that affects the payment process | Your site embeds or redirects to a payment iframe, but the surrounding page isn’t fully hosted elsewhere |
| SAQ B | Standalone terminal, no electronic storage | Dial-up or IP-connected standalone terminal, card data never touches your computer network |
| SAQ B-IP | Standalone, IP-connected terminal (no P2PE) | Terminal connects via IP but still processes independently of your network; card data isn’t stored electronically |
| SAQ P2PE | Validated point-to-point encryption solution | Separate questionnaire for merchants using a PCI-listed P2PE solution end-to-end — not the same as SAQ B-IP, which has no P2PE requirement |
| SAQ C | POS system connected to the internet | Payment application connected to internet, not storing card data electronically |
| SAQ C-VT | Virtual terminal, manual entry | Web-based virtual terminal, manually keying in card numbers |
| SAQ D | Everyone else | You store, process, or transmit card data directly — the most comprehensive questionnaire |
The Most Common Small Business Mistake
Business owners frequently assume they qualify for the simplest SAQ A just because they “use a payment processor,” without checking whether their checkout flow is actually fully hosted. If your website embeds a payment iframe or redirects partway through checkout rather than sending customers to a completely separate hosted page, you may actually need SAQ A-EP — a meaningfully more involved questionnaire that your processor or acquiring bank can help confirm.
New E-Commerce Script Requirements
Recent PCI DSS updates added specific requirements around third-party and fourth-party scripts loaded on payment pages — think chat widgets, analytics tags, or ad pixels that sit on the same page as your checkout. These scripts now need to be inventoried and their integrity monitored, since a compromised third-party script is a documented attack vector for stealing card data directly off an otherwise-compliant checkout page, even one that qualifies for SAQ A.
Phone Orders and Virtual Terminals
Taking card numbers over the phone and manually entering them into a web-based virtual terminal puts you in SAQ C-VT territory, not the simpler SAQ A or B — the manual entry step and the fact that you’re handling the raw card number, even briefly, changes your compliance obligations compared to a hosted checkout flow.
How This Fits Your Broader Compliance Picture
PCI DSS compliance is one piece of a broader small business security posture — see our PCI DSS compliance guide for the full standard beyond just picking your SAQ type, including the underlying 12 requirements that apply regardless of which questionnaire you file.
Getting It Wrong Has Real Consequences
Filing the wrong SAQ isn’t just a paperwork problem — if a breach occurs and your actual setup doesn’t match what you attested to, your acquiring bank and card brands can impose fines, and your cyber insurance claim could be affected by the misstatement — PCI compliance status is now a standard question on most cyber insurance applications. When in doubt, your payment processor’s compliance team or a QSA (Qualified Security Assessor) can confirm which SAQ actually matches your setup before you self-attest to the wrong one. Quarterly external vulnerability scanning by an Approved Scanning Vendor (ASV) is also required for several SAQ types — notably C, A-EP, and B-IP — but not for SAQ A or SAQ B, so confirm which rule actually applies to your SAQ type rather than assuming scanning is universal. See our vulnerability scanning guide for budgeting it in where it does apply.
Bottom Line
Match your SAQ to how card data actually flows through your specific setup, not to the simplest option available — a hosted checkout page is SAQ A, but an embedded iframe, phone orders, or a connected POS system each require a more involved questionnaire.
Official sources: PCI Security Standards Council — SAQ Documents, FTC — Small Business Cybersecurity.
