Frequently Asked Question
Can SAQ eligibility criteria be used as a guide for determining applicability of PCI DSS requirements for merchant assessments documented in a Report on Compliance?
SAQs are compliance reporting tools developed by PCI SSC that are intended to help merchants document compliance with PCI DSS requirements under appropriate conditions, for designated use cases, and are subject to any applicable rules and requirements of the organizations responsible for managing compliance programs (e.g., payment brands and acquirers).
SAQs should not be used as a “guide” for determining the applicability of PCI DSS requirements unless explicitly reviewed, discussed and agreed upon with the merchant’s compliance accepting entity (e.g., payment brands and acquirers). For the avoidance of doubt, merchants should always consult with the organizations responsible for managing compliance programs to confirm their PCI DSS validation and reporting requirements.
For further information please refer to FAQ #1473: What is the role of compliance-accepting entities and assessors in determining the applicability of PCI DSS requirements for merchant and service provider PCI DSS assessments?
Contact information for the payment brands can be found in FAQ #1142: How do I contact the payment card brands?