Question 1

What is PCI DSS and who needs to comply?

Accepted Answer

PCI DSS (Payment Card Industry Data Security Standard) applies to any organization that stores, processes, or transmits cardholder data. This includes merchants accepting card payments and service providers handling card data on behalf of others.

Question 2

How do I know which SAQ type I need?

Accepted Answer

Your SAQ type depends on how you accept payments: SAQ A for fully outsourced e-commerce, SAQ B for imprint/dial-out terminals, SAQ B-IP for IP terminals, SAQ C for payment applications, SAQ C-VT for virtual terminals, SAQ P2PE for P2PE solutions, and SAQ D for all other environments.

Question 3

What is the difference between SAQ and ROC?

Accepted Answer

SAQ (Self-Assessment Questionnaire) is for self-validation by smaller merchants and service providers. ROC (Report on Compliance) is a formal assessment by a QSA required for Level 1 merchants (>6M transactions) and Level 1 service providers (>300K transactions).

Question 4

What are PCI DSS merchant levels?

Accepted Answer

Level 1: >6M transactions/year (requires ROC). Level 2: 1-6M transactions. Level 3: 20K-1M e-commerce transactions. Level 4: <20K e-commerce or <1M total transactions. Levels 2-4 typically use SAQ self-assessment.

Question 5

What additional requirements apply beyond the SAQ?

Accepted Answer

Most merchants need quarterly ASV (Approved Scanning Vendor) scans for external-facing systems. Level 1 and 2 merchants also need annual penetration testing. All must submit an AOC (Attestation of Compliance) to their acquiring bank.

PCI DSS SAQ Selector

PCI DSS SAQ Selector