Guide
PCI SAQ C for merchants with internet-connected payment systems
PCI SAQ C applies to merchants whose payment application systems connect to the internet but do not store card data electronically. So it suits many small shops and restaurants running a point-of-sale system.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
Who uses PCI SAQ C
It fits when the payment application and the internet connection are on the same device or local network. The form is in the PCI SSC document library.
- A payment application system connected to the internet
- No electronic storage of card data
- Systems not connected to other locations
- No e-commerce channel
SAQ C compared with SAQ C-VT
The two sound alike. However, they describe different setups.
| SAQ C | SAQ C-VT | |
|---|---|---|
| Setup | Payment application on your system. | Manual entry into a provider's web terminal. |
| Storage | None electronically. | None. |
| Typical user | Shop or restaurant POS. | Phone or mail order with keyed entry. |
PCI SAQ C readiness check
Tick what is in place.
Your result appears here as you tick, so you can see what is still open.
What PCI SAQ C asks
Because the system touches the internet, the form covers network controls, secure configuration, malware protection, access control and logging. Also, quarterly external scans are typically required. Therefore the work is moderate rather than minimal.
Most of it is ordinary hygiene. For example, changing default passwords and keeping the system patched answer several questions at once.
Reducing scope
Moving to validated encryption terminals can shift you to SAQ P2PE, which is much shorter. So compare equipment costs with ongoing compliance work.
Our role with PCI SAQ C
We secure the setup and prepare the evidence with you. However, your executive signs the form, and we are not a QSA.
Also keep a simple inventory of the devices in your payment setup, including the router. Several questions ask about it, and an accurate list makes the rest of the form faster to answer honestly. Update it whenever equipment changes or a new device joins the network.
PCI SAQ C questions
Does a cloud POS use PCI SAQ C?
It depends on the setup. Some cloud systems with encrypting terminals fit other forms, so check.
Do we need ASV scans with PCI SAQ C?
Typically yes, quarterly, so plan for them.
Can we move to a shorter form?
Validated encryption terminals can move you to SAQ P2PE.
Who signs it?
Your executive.
Related guides
Secure your POS setup before you sign
Tell us your POS system and terminals. We reply with the likely form and a written estimate.
Get my written estimate