Understanding SAQ A Eligibility for E-Commerce PCI Compliance
Published: Mar 17, 2025
For e-commerce merchants, navigating PCI compliance can be complex, especially when it comes to determining eligibility for Self-Assessment Questionnaire A (SAQ A). If you're unsure whether your business qualifies or what completing the SAQ entails, this guide will help clarify key requirements, recent updates, and potential consequences of non-compliance.
Who Qualifies for SAQ A?
SAQ A is specifically designed for e-commerce and mail/telephone order merchants that accept card-not-present transactions. To qualify, you must meet several key criteria:
- No Cardholder Data Storage
Your systems cannot store, process, or transmit cardholder data in any way. - Fully Outsourced Processing
All payment processing must be handled by a PCI DSS-compliant third-party service provider. - Service Provider Compliance
The provider must be fully PCI-compliant for the services they offer. - Limited Data Retention
If you retain cardholder data, it can only be on paper. - Third-Party Hosted Payment Page
Your payment page must originate entirely from a PCI DSS validated service provider. - Protection from Script-Based Attacks
You must ensure your website is safeguarded against script-based threats (a new pre-requisite).
If you meet these conditions, you may be eligible to complete SAQ A instead of undergoing a more complex PCI DSS assessment.
Preparing for and Completing SAQ A
Once you've confirmed your eligibility, follow these steps to prepare for and complete your SAQ A:
1. Obtain an Attestation of Compliance (AOC)
Your third-party service provider should provide a PCI DSS AOC document that is less than one year old verifying their PCI DSS compliance. This is a critical part of your assessment.
2. Plan Your Assessment
Determine whether your organization will conduct the assessment internally or work with a Qualified Security Assessor (QSA). Large companies often rely on their GRC (Governance, Risk, and Compliance) teams, while smaller businesses may delegate the responsibility to a CISO, CTO, or CIO.
3. Allocate Time for Completion
The time required to complete SAQ A varies based on factors like the number of external websites and payment pages. Generally, expect the process to take one to three weeks.
4. Maintain Thorough Documentation
Completion of the SAQ A is an annual requirement, so documenting your assessment plan and keeping detailed records will help streamline future compliance efforts.
Recent Changes to SAQ A
The PCI Security Standards Council has announced a new revision of SAQ A, which will take effect at the end of March 2025. This update simplifies some requirements, including the removal of several payment page script management obligations. If you're preparing for compliance, it's crucial to stay informed about these changes to ensure a smooth transition.
What Happens If You Don’t Complete an SAQ?
Failing to complete a required PCI assessment can lead to serious consequences, which vary depending on your acquiring bank or payment processor. Potential penalties include:
- Monthly fines for non-compliance
- Higher per-transaction fees
- Loss of credit card processing capabilities
Beyond compliance, the primary goal is protecting your customers' data. Adhering to PCI DSS helps safeguard payment information and strengthens overall security for your business.
Stay Informed and Stay Secure
SAQ A compliance is a critical part of ensuring secure transactions for e-commerce merchants. As PCI DSS requirements evolve, staying proactive will help you avoid penalties, protect customer data, and simplify future assessments.
For more details on the upcoming SAQ A revisions, stay tuned for our next deep dive into the 2025 PCI updates. In the meantime, if you have questions or need guidance, contact us today and we'll be in touch soon. You can also discover other important PCI updates for E-commerce merchants in these helpful resources:
About Matt Crane
Matt Crane is a Director at Schellman, where he excels in project management and client relations while overseeing assessments against various PCI Standards. With a primary focus on PCI DSS Compliance for organizations spanning diverse industries, Matt leverages a decade of expertise in information security services. Prior to joining Schellman in July 2017, Matt held key positions in both the private and public sectors, specializing in PCI and NIST assessments, as well as intelligence analysis. His extensive background includes leading PCI engagements, performing risk assessments, and general consulting services for merchants and service providers across multiple industry verticals. With an exceptional track record and a profound understanding of the industry, Matt Crane is a valuable asset to Schellman, ensuring clients receive unparalleled guidance in achieving their compliance goals. Matt holds a BBA in Information Security and Assurance as well as several industry certifications including CISSP, CISA, CRISC, QSA,