Guide
PCI SAQ A: the shortest form, and who really qualifies
PCI SAQ A is the shortest self-assessment questionnaire. It suits merchants who fully outsource card handling to a compliant provider, so no card data touches their own systems.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
Who qualifies for PCI SAQ A
Eligibility is strict. Therefore check every condition, not just the obvious one. The form is in the PCI SSC document library.
- You accept only card-not-present transactions
- All card processing is outsourced to a compliant provider
- Your systems never store, process or transmit card data
- Payment pages come entirely from the provider
- You confirmed the provider is compliant
Redirects and embedded payment frames
A redirect to a hosted payment page or a provider's embedded frame can keep you in SAQ A. However, if your own page delivers scripts that affect the payment form, you usually move to SAQ A-EP. So the technical detail decides the form.
PCI SAQ A eligibility check
Tick each statement that is true. All five should be true for SAQ A.
Your result appears here as you tick, so you can see what is still open.
What PCI SAQ A asks
The form covers a small set of requirements, such as managing passwords on your systems and keeping a list of service providers. Also, version 4.0.1 changed some script-related items, so use the current form rather than an old copy.
| Topic | Typical question |
|---|---|
| Providers | Do you keep a list of service providers and their compliance? |
| Website | Is your site protected against unauthorised changes? |
| Incidents | Do you have an incident response plan? |
Mistakes that disqualify merchants
Common mistakes include taking card details by email or phone, keeping paper records of card numbers and adding analytics scripts to the payment page. Each one can move you out of PCI SAQ A, so review them honestly.
If any apply, the fix is often simple. For example, stopping email collection of card numbers can restore eligibility.
Our role with PCI SAQ A
We check eligibility and help you complete the form accurately. However, your executive signs it, and we are not a QSA.
PCI SAQ A questions
Is PCI SAQ A enough for a small online shop?
Often, yes, if the payment page is fully hosted by a compliant provider.
Do we need ASV scans with SAQ A?
Requirements vary by version and acquirer, so confirm with your acquirer.
What moves us from PCI SAQ A to A-EP?
Usually, your own page affecting the payment form, for example by delivering scripts.
Who signs it?
Your executive, after completing it honestly.
Related guides
Confirm you qualify for SAQ A
Describe your checkout. We confirm the likely form and reply with a written estimate if you need help.
Get my written estimate