PCI DSS SAQ Types Explained: Which One Your US Business Needs

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• A fixed quote

  A fixed quote follows a free gap assessment, so you know the full cost before you commit.

The outcome. Done for you: the correct form, gaps closed and a submission ready to sign, on your deadline.

We start with the scoping memo: where card data enters, travels and could settle by accident. From that we recommend the smallest form your environment genuinely supports, and we say plainly when a design change, such as a fully hosted payment page, would shrink it. Then we run the free gap assessment, close control gaps, collect evidence, review it internally and prepare the submission in the format your acquirer or customer accepts.

A Qualified Security Assessor (QSA) performs the assessment and Report on Compliance where one is required; for SAQ-eligible merchants and service providers we prepare and support the SAQ. You deal with Sterling throughout, backed by 100% success and on-time completion over 20+ years. A fixed quote follows the free gap assessment.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

The outcome. The right questionnaire, chosen once, so you submit on time and avoid redoing the work for a bigger form later.

US merchants usually meet the Self-Assessment Questionnaire through their acquiring bank or payment processor; US software vendors meet it through an enterprise customer's vendor review. The PCI Security Standards Council describes SAQs as validation tools that help eligible merchants and service providers carry out and report their own PCI DSS self-assessment^[3]. You answer for your environment, sign an attestation and send the package to whoever requested it.

Two points catch founders out:

• The Council does not choose your route. Its standard page says whether an entity must comply with or validate to a PCI standard is at the discretion of the organizations running compliance programs, such as a payment brand or an acquirer^[1]. Your merchant bank, or your customer, tells you which form it accepts.
• It is a self-assessment. No one independent checks your answers unless the recipient requests more, so accurate answers backed by evidence matter as much as the controls.

The Council advises contacting the receiving entity before you start, to confirm an SAQ is acceptable and to get any specific instructions^[3]. That one call prevents more wasted effort than any other step here.

Which form fits depends on how card data reaches your business, not on headcount or revenue. The plain-language summary below is Sterling's; the formal eligibility criteria printed in each SAQ document decide the outcome.

The outcome. A shortlist of one or two forms in under an hour, with a memo that justifies the choice.

1. Merchant or service provider? Eligible service providers use SAQ D for service providers, the only SAQ open to them^[2]. Every other form is for merchants. 2. How do customers pay? Online, in person at a terminal, through a phone app or by phone with an operator keying the number. Each channel has its own shortlist. 3. Where does the card number go first? If it travels straight from the customer's browser or device to the processor and never lands on your servers, your scope is far smaller. 4. Does anything of yours keep card data afterwards? Logs, call recordings, tickets, spreadsheets and screenshots all count. One stray store can push you from a short form to the full one.

Write the answers into a one-page scoping memo with a simple payment-flow diagram. It shows the form was chosen for a reason, and it is the first thing a reviewer requests.

The outcome. You claim the form your checkout genuinely qualifies for, and it holds up when your acquirer looks closer.

The usual mistake among US online start-ups is picking SAQ A because the processor's name appears at checkout. The form depends on how the page is built:

• Redirect. The customer leaves your site and pays on a page the processor serves.
• Embedded form. The processor's content, such as an iframe, sits inside your page, but your page still controls the code around it.
• Direct post. Your page collects the details and posts them to the processor, which keeps your servers in the data path and normally means a larger questionnaire.

Version 4.x raises the stakes. The Council says merchant sites embedding a payment page or form from a third-party provider need protection against unauthorized script activity on that page, and that external scans by an Approved Scanning Vendor apply to sites that redirect to, or embed a form from, a third-party provider^[2]. Its FAQ library also features a question on how e-commerce merchants meet the SAQ A eligibility criteria for scripts^[5]. If you chose SAQ A some time ago, check again.

Every SAQ was reissued for PCI DSS v4.0, and most grew. The Council reports that requirement wording now mirrors the standard, responses line up with the Report on Compliance template, and each SAQ includes guidance for the person completing it^[2]. Version 3.2.1 was retired on March 31, 2024^[6]. The current text is v4.0.1, a limited June 2024 revision that clarified requirements and corrected errors without adding or deleting any^[4]. Requirements noted as best practices until March 31, 2025 must now be fully considered^[2].

Additions the Council lists across the SAQs include data-retention policies where paper holds card data, malware protection covering phishing, stronger password and multi-factor expectations, audit-log review, and named people on call around the clock in the larger forms^[2]. Small forms gained fewer additions than large ones: one more reason scope reduction pays.

A software company that stores, processes or transmits card data for customers, or could affect its security, is a service provider in PCI terms^[1]. It does not pick between lettered forms: the service-provider SAQ D is the only one available^[2], and the v4.0 release added documentation on the assessed environment and descriptions of testing results^[3]. Whether self-assessment is allowed at all is for the card brand, acquirer or customer to decide, and in Sterling's experience many US enterprise buyers prefer a Report on Compliance. See SAQ versus ROC and PCI DSS for SaaS.

• Choosing by effort. Your environment decides the form; claiming a shorter one than your set-up allows invalidates the attestation you sign.
• Forgetting side channels. Support tools, email, chat transcripts and spreadsheets are where unplanned card data hides.
• Borrowing the processor's validation. It covers the processor; you still answer for the parts of the flow you control.
• Using an old edition. Pull the current 4.x document and check the attestation dates.
• Skipping the acquirer conversation. Eligibility to self-assess is not yours to declare.
• Signing without evidence. The attestation is a statement of fact; a thin file behind it creates risk after an incident.

This is Sterling's recommendation, not a rule of the PCI Security Standards Council.

• Ask your acquirer, or the requesting customer, which validation it accepts before choosing anything.
• Design card data out wherever you can; a hosted payment page or validated encrypted terminal is usually the strongest scope cut open to a start-up.
• Keep one payment-flow diagram and update it whenever checkout changes.
• Run the gap assessment against the current 4.x text, not an old checklist.
• Give the SAQ an annual owner and calendar date.
• If a customer wants more than a self-assessment, move early to the SAQ versus ROC question; the PCI DSS hub gives the wider picture.

Not sure which form is yours? Get started with a short call about your checkout.

PCI DSS is validated in one of two ways, depending on how you handle card data and what your acquirer or card brand requires. A Qualified Security Assessor (QSA) performs the assessment and Report on Compliance where one is required^[1]; for SAQ-eligible merchants and service providers we prepare and support the SAQ.

Either way, you work with Sterling from first scoping call to final submission. We coordinate:

• scoping: where card data is stored, processed or transmitted, and how to shrink that footprint;
• a gap assessment against the current version of the standard;
• the policies, procedures and technical control improvements needed to close the gaps;
• evidence collection and an internal review before anyone external looks at your environment;
• the assessment itself, including scheduling, evidence requests and follow-up questions.

What you receive is a validation of compliance, documented in the form your acquirer or card brand accepts. Our experts bring 30+ years of experience, and Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years.

^[1] Become a Qualified Security Assessor (QSA). PCI Security Standards Council. accessed October 23, 2026.

• PCI DSS: standard overviewStandard overview
• Meet US Contract, MSA and RFP Compliance Clauses FastUnited States
• PCI DSS SAQ vs ROC: Which Route Your US Business NeedsUnited States
• PCI DSS for US SaaS Companies: Scope, Roles and Buyer RequestsUnited States
• PCI DSS 4.0.1 Requirements in Plain English for US BusinessesUnited States
• Sterling in the United StatesUnited States

1. PCI Data Security Standard (PCI DSS). PCI Security Standards Council. accessed October 23, 2026.

2. PCI DSS v4: What's New with Self-Assessment Questionnaires. PCI Perspectives Blog, PCI Security Standards Council. accessed October 23, 2026.

3. Bulletin: SAQs for PCI DSS v4.0 are Now Available. PCI Security Standards Council. accessed October 23, 2026.

4. Just Published: PCI DSS v4.0.1. PCI Perspectives Blog, PCI Security Standards Council. accessed October 23, 2026.

5. Frequently Asked Questions. PCI Security Standards Council. accessed October 23, 2026.

6. PCI DSS v3.2.1 is Retiring on 31 March 2024 - Are You Ready?. PCI Perspectives Blog, PCI Security Standards Council. accessed October 23, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.