Submit the SAQ and Attestation of Compliance, with any other requested such as ASV scan reports—to your acquirer, payment brand or other requester. Understanding the Self-Assessment Questionnaire The questions contained in the DSS Question” column in this self-assessment questionnaire are “PCI based on the requirements in the PCI DSS. Additional resources that provide guidance on PCI DSS requirements and how to complete the assessment questionnaire have been provided to assist with the assessment process. An overview of some of these resources is provided below: Document Includes: PCI DSS Guidance on Scoping Guidance on the intent of all PCI DSS Requirements (PCI Data Security Standard Details of testing procedures Requirements and Security Assessment Guidance on Compensating Controls Procedures) SAQ Instructions and Guidelines Information all SAQs and their eligibility criteria documents How to determine which SAQ is right for your organization PCI DSS and PA-DSS Glossary of Terms, Descriptions and definitions of used in the PCI Abbreviations, and Acronyms DSS and self-assessment questionnaires and other resources can be found on the PCI SSC website (). Organizations are encouraged to review the PCI DSS and other supporting documents before beginning an assessment. Expected Testing The instructions provided in the Testing” column are based on the testing procedures in the “Expected PCI DSS, and provide a high-level description of the types of testing activities that should be performed in order to verify that a requirement has been met. Full details of testing procedures for each requirement can be found in the PCI DSS. Completing the Self-Assessment Questionnaire For each question, there is a choice of responses to indicate your company’s status regarding that requirement. Only one response should be selected for each question. A description of the meaning for each response is provided in the table below: When to use this response: Response Yes The expected testing has been performed, and all elements of the requirement have been met as stated.
Submit the SAQ and Attestation of Compliance, with any other requested as ASV scan reports—to your acquirer, payment brand or other requester. Understanding the Self-Assessment Questionnaire The questions contained in the “PCI DSS Question” column in this self-assessment questionnaire are based on the requirements in the PCI DSS. Additional resources that provide guidance on PCI DSS requirements and how to complete the questionnaire have been provided to assist with the assessment process. An overview of some of these resources is provided below: Document Includes: PCI DSS (PCI Data Security Standard Requirements and Security Assessment Procedures) Guidance on Scoping Guidance on the intent of all PCI DSS Requirements Details of testing procedures Guidance on Compensating Controls SAQ Instructions and Guidelines documents Information all SAQs and their eligibility criteria How to determine which SAQ is right for your organization PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms Descriptions and definitions of used in the PCI DSS and self-assessment questionnaires and other resources can be found on the PCI SSC website (). Organizations are encouraged to review the PCI DSS and other supporting documents before beginning an assessment. Expected Testing The instructions provided in the “Expected Testing” column are based on the testing procedures in the PCI DSS, and provide a high-level description of the types of testing activities that should be performed in order to verify that a requirement has been met. Full details of testing procedures for each requirement can be found in the PCI DSS. Completing the Self-Assessment Questionnaire For each question, there is a choice of responses to indicate your company’s status regarding that requirement. Only one response should be selected for each question. A description of the meaning for each response is provided in the table below: Response When to use this response: Yes The expected testing has been performed, and all elements of the requirement have been met as stated. such assessment
saq_a_v3_1_instr.docx