Before You Begin SAQ D for Merchants applies to SAQ-eligible merchants not meeting the criteria for any other SAQ type. Examples of merchant environments that would use SAQ D may include but are not limited to: E-commerce merchants who accept cardholder data on website. Merchants with electronic storage of cardholder data Merchants that don’t store cardholder data electronically but that do not meet the criteria of another SAQ type Merchants with environments that might meet the criteria of another SAQ type, but that have additional PCI DSS requirements applicable to their environment While many organizations completing SAQ D will need to validate compliance with every PCI DSS requirement, some organizations with very specific business models may find that some requirements do not apply. See the guidance below for information about the exclusion of certain, specific requirements. PCI DSS Self-Assessment Completion Steps Identify the applicable SAQ for your environment refer to the Self-Assessment Questionnaire – Instructions and Guidelines document on PCI SSC website for information. Confirm that your environment is properly scoped and meets the eligibility criteria for the SAQ you are using. Assess your environment for compliance with PCI DSS requirements. Complete all sections of this document: Section 1 (Part 1 & 2 of the AOC) Assessment Information and Executive Summary. – Section 2 PCI DSS Self-Assessment Questionnaire (SAQ D) – Section 3 (Parts 3 & 4 of the AOC) Validation and Attestation Details and Action Plan for – Compliant Requirements (if applicable) Submit the SAQ and Attestation of Compliance, along with any other requested documentation—such as ASV scan reports—to your acquirer, payment brand or other requester. Understanding the Self-Assessment Questionnaire The questions contained in the DSS Question” column in this self-assessment questionnaire are “PCI on the requirements in the PCI DSS. Additional resources that provide guidance on PCI DSS requirements and how to complete the assessment questionnaire have been provided to assist with the assessment process. An overview of some of these resources is provided below: Document Includes: PCI DSS Guidance on Scoping Guidance on the intent of all PCI DSS Requirements (PCI Data Security Standard Details of testing procedures Requirements and Security Assessment Guidance on Compensating Controls Procedures) SAQ Instructions and Guidelines Information about all SAQs and their eligibility criteria documents How to determine which SAQ is right for your organization
Before You Begin SAQ D for Merchants applies to SAQ-eligible merchants not meeting the criteria for any other SAQ type. Examples of merchant environments that would use SAQ D may include but are not limited to: E-commerce merchants who accept cardholder data on website. Merchants with electronic storage of cardholder data Merchants that don’t store cardholder data electronically but that do not meet the criteria of another SAQ type Merchants with environments that might meet the criteria of another SAQ type, but that have additional PCI DSS requirements applicable to their environment While many organizations completing SAQ D will need to validate compliance with every PCI DSS requirement, some organizations with very specific business models may find that some requirements do not apply. See the guidance below for information about the exclusion of certain, specific requirements. PCI DSS Self-Assessment Completion Steps Identify the applicable SAQ for your environment – refer to the Self-Assessment Questionnaire Instructions and Guidelines document on PCI SSC website for information. Confirm that your environment is properly scoped and meets the eligibility criteria for the SAQ you are using. Assess your environment for compliance with PCI DSS requirements. Complete all sections of this document: Section 1 (Part 1 & 2 of the AOC) – Assessment Information and Executive Summary. Section 2 – PCI DSS Self-Assessment Questionnaire (SAQ D) Section 3 (Parts 3 & 4 of the AOC) – Validation and Attestation Details and Action Plan for Requirements (if applicable) Submit the SAQ and Attestation of Compliance, along with any other requested documentation—such as ASV scan reports—to your acquirer, payment brand or other requester. Understanding the Self-Assessment Questionnaire The questions contained in the “PCI DSS Question” column in this self-assessment questionnaire are on the requirements in the PCI DSS. Additional resources that provide guidance on PCI DSS requirements and how to complete the questionnaire have been provided to assist with the assessment process. An overview of some of these resources is provided below: Document Includes: PCI DSS (PCI Data Security Standard Requirements and Security Assessment Procedures) Guidance on Scoping Guidance on the intent of all PCI DSS Requirements Details of testing procedures Guidance on Compensating Controls SAQ Instructions and Guidelines documents Information about all SAQs and their eligibility criteria How to determine which SAQ is right for your organization assessment Compliant
SAQ_D_v3_Merchant.docx