Guide
PCI SAQ D: the full questionnaire, and how to make it smaller
PCI SAQ D is the questionnaire for anyone who does not fit a shorter form. It covers almost every requirement, so it can run past 300 questions, and the real work is reducing scope before you start.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
Who must use PCI SAQ D
It applies when no other form fits. For example, merchants who store card data, use several combined channels or run payment software on their own network often land here. Service providers eligible to self-assess use a separate D version. The forms are in the PCI SSC document library.
Why it is so long
It covers nearly all twelve requirements, because your environment touches card data directly. Therefore it asks for network controls, logging, testing, policies and more.
| Version | For |
|---|---|
| SAQ D for merchants | Merchants not eligible for a shorter form. |
| SAQ D for service providers | Service providers allowed to self-assess. |
PCI SAQ D readiness check
Tick what is already true.
Your result appears here as you tick, so you can see what is still open.
Shrinking scope before PCI SAQ D
Scope reduction is the biggest saving. So consider stopping storage, tokenising card data or moving to validated encryption terminals.
- Stop storing card numbers you do not need
- Tokenise through your payment provider
- Segment the network so fewer systems are in scope
- Use validated point-to-point encryption terminals
Each step removes systems from the card environment. As a result, the questions that remain become easier to answer.
When a full assessment is required instead
Self-assessment is not always allowed. For example, Level 1 merchants usually need a Report on Compliance from a QSA. Also, your acquirer can require an assessor regardless of level.
Our role with PCI SAQ D
We reduce scope, close gaps and prepare evidence for the questionnaire. However, your executive signs it, and we are not a QSA.
Also keep a record of each scope decision, such as why a system sits outside the card environment. Assessors and acquirers ask for that reasoning, and a clear note saves time.
PCI SAQ D questions
How long is PCI SAQ D?
It can run past 300 questions, depending on version and scope.
Can we move to a shorter SAQ?
Often, by reducing scope, for example by stopping storage or using hosted payments.
Does PCI SAQ D need an assessor?
No, it is self-assessed, unless your level or acquirer requires a QSA.
Who signs it?
Your executive.
Related guides
Shrink your scope before SAQ D
Describe how you take and store payments. We reply with scope options and a written estimate.
Get my written estimate