Guide
PCI SAQ C VT for virtual terminal merchants
PCI SAQ C VT covers merchants who key card payments into a web-based virtual terminal. So the form is short, but the workstation rules are strict.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
Who fits PCI SAQ C VT
The setup must match closely. However, many phone-order merchants do qualify.
- Payments keyed one at a time into a virtual terminal
- The virtual terminal is hosted by a PCI DSS validated provider
- The workstation is not connected to other systems in your environment
- No electronic storage of card data
Workstation rules in PCI SAQ C VT
The computer used for keying is the risk. Therefore it should be dedicated, patched and protected, with nothing else on it.
| Control | Why it matters |
|---|---|
| Dedicated device | Fewer apps mean fewer ways in. |
| Patching and anti-malware | Keyloggers would capture every card number. |
| No card data saved | No files, notes or screenshots of numbers. |
PCI SAQ C VT readiness check
Tick what is true for every keying workstation.
Your result appears here as you tick, so you can see what is still open.
Where PCI SAQ C VT goes wrong
Staff write card numbers on paper or in spreadsheets before keying. For example, a shared notes file of callbacks. Also, the same computer is used for email and browsing.
Paper handling
Paper is still card data. So store any written numbers securely, keep them only as long as needed and destroy them safely afterwards.
Where we help
We confirm eligibility, review the workstation setup and complete the form with you. SAQ completion support runs $500 to $20,000. We are not a QSA. Forms are in the PCI SSC document library.
Also train staff on the keying routine. For example, numbers are read from the caller and typed directly, without notes. So the workstation stays the only place card data appears. In addition, review the routine yearly, because new staff often bring old habits with them.
PCI SAQ C VT questions
Can we use PCI SAQ C VT with a card reader attached?
Card readers usually change the form. Check the eligibility criteria first.
Is PCI SAQ C VT right for phone orders?
Often, yes, if staff key each payment into a hosted virtual terminal.
Can staff use the PCI SAQ C VT workstation for email?
It is safer not to, because email brings malware risk to the keying device.
Who signs the attestation?
An officer of your business signs it.
Related guides
Confirm your fit for PCI SAQ C VT
Describe how staff take payments. We reply with a written estimate, usually inside one business day.
Get my written estimate