PCI DSS · Self-Assessment

PCI DSS SAQ Selection

Find the right SAQ for your business — a decision guide across all nine SAQ types.

How to find your SAQ

Key criteria: electronic storage · payment channel · processing location · P2PE validated · service provider status.

1 · Are you a service provider?

Yes → SAQ D (Service Provider)No ↓

2 · Do you store, process or transmit cardholder data?

No → SAQ AYes ↓

Card-not-present

E-commerce with the payment page on your own site?

Yes → SAQ A-EP

Virtual terminal only (browser-based entry)?

Yes → SAQ C-VTNo → SAQ C / SAQ D

Card-present

What type of terminal do you use?

Imprint / dial-out → SAQ BStandalone IP → SAQ B-IPValidated P2PE → SAQ P2PEOther systems → SAQ D (Merchant)

The SAQ types at a glance

SAQ ACard-not-present, fully outsourced — third-party services, redirect to payment page.

SAQ A-EPE-commerce with an outsourced payment page (iframe / hosted forms).

SAQ C-VTVirtual terminal, no electronic storage — mail/phone order, browser-based entry.

SAQ BImprint machines or standalone dial-out terminals.

SAQ B-IPStandalone IP terminals, no electronic storage (countertop terminals).

SAQ P2PEHardware terminals with a validated point-to-point encryption solution.

SAQ CPayment application on an internet-connected system (software on computers).

SAQ D (Merchant)All other merchants — multi-channel, custom integrations, electronic storage.

SAQ D (Service Provider)All service providers defined by the payment brands — gateways, hosting, MSPs.

Card-not-presentCard-presentHybrid / complexService provider / catch-all

Cianaa Technologies — independent PCI, ISO & SOC assessments across NZ & AU.Book a scoping call →