PCI DSS SAQ Decision Tree: Find Your Assessment Type
Not sure which PCI DSS Self-Assessment Questionnaire applies to your organization? Walk through our step-by-step decision tree to determine the right SAQ type based on how you handle cardholder data.
Six questions stand between you and the correct SAQ classification. Answer each one honestly to narrow down your assessment type.
How the SAQ Decision Process Works
The PCI Security Standards Council defines nine SAQ types, each tailored to a specific payment processing environment. Selecting the correct SAQ depends on how your organization accepts, processes, stores, and transmits cardholder data — as well as which payment channels and technologies you use.
The decision tree below guides you through a series of yes-or-no questions about your payment infrastructure. Each answer either identifies your SAQ type or narrows the possibilities further. Start at Step 1 and follow the path that matches your environment.
SAQ Decision Tree
Do you store, process, or transmit cardholder data?
The first question determines whether PCI DSS applies to your organization at all. Cardholder data includes the primary account number (PAN), cardholder name, expiration date, and service code. If your business never touches card data in any form — for example, you only accept cash or bank transfers — PCI DSS may not apply.
Continue to Step 2
You may not need PCI DSS compliance. Confirm with your acquirer.
Are all your payment channels card-not-present (e-commerce, MOTO)?
Card-not-present (CNP) transactions include e-commerce purchases, mail orders, and telephone orders where the physical card is not swiped, dipped, or tapped. If all your payment acceptance methods are CNP, you are likely eligible for SAQ A or SAQ A-EP, depending on how your payment page is integrated.
Likely SAQ A or SAQ A-EP depending on payment integration
You have card-present channels. Continue to Step 3.
Do you use a PCI-validated Point-to-Point Encryption (P2PE) solution?
PCI-validated P2PE solutions encrypt cardholder data at the point of interaction (the terminal) and decrypt it only in the secure decryption environment of the solution provider. If your P2PE solution appears on the PCI SSC list of validated P2PE solutions, you qualify for the simplified SAQ P2PE assessment.
SAQ P2PE — simplified assessment for validated P2PE merchants
Continue to Step 4
Do you only use standalone dial-out terminals with no electronic storage?
Standalone dial-out terminals connect to the payment processor over a traditional phone line and do not store cardholder data electronically. These terminals are not connected to your network or the internet. If this is your sole payment channel, you qualify for SAQ B — one of the simplest card-present assessments.
SAQ B — standalone dial-out terminals only
Continue to Step 5
Do you only use IP-connected payment terminals (no electronic cardholder data storage)?
IP-connected terminals communicate with the payment processor over your network or the internet but do not store cardholder data after authorization. This includes countertop terminals, PIN pads, and mobile card readers that connect via Ethernet, Wi-Fi, or cellular. Depending on whether your terminal has a payment application, you qualify for SAQ B-IP or SAQ C.
SAQ B-IP or SAQ C — IP-connected terminals without storage
Continue to Step 6
Do you only process payments via a web-based virtual terminal?
A virtual terminal is a web browser-based payment entry interface provided by your payment processor. An operator manually keys in card numbers for phone or mail orders. If the virtual terminal is your only method of accepting card payments and you do not store cardholder data electronically, you qualify for SAQ C-VT.
SAQ C-VT — virtual terminal only, no electronic storage
SAQ D — the comprehensive self-assessment applies
SAQ Type Summary
The following table provides a quick reference for each SAQ type, including the key eligibility criteria, approximate number of requirements, and the typical merchant profile.
| SAQ Type | Key Criteria | Requirements | Typical Merchant |
|---|---|---|---|
| SAQ A | Card-not-present, fully outsourced payment page (redirect/iframe) | ~22 | E-commerce with hosted checkout, MOTO |
| SAQ A-EP | Card-not-present, website affects payment data security (JS SDK) | ~191 | E-commerce with embedded payment forms |
| SAQ B | Standalone dial-out terminals only, no electronic CHD storage | ~41 | Small retail with phone-line terminals |
| SAQ B-IP | IP-connected PTS terminals, no electronic CHD storage | ~82 | Retail with networked terminals |
| SAQ C | Payment application on IP-connected terminal, no CHD storage | ~160 | Retail with POS payment applications |
| SAQ C-VT | Web-based virtual terminal only, no electronic CHD storage | ~79 | MOTO merchants keying data into browser |
| SAQ P2PE | PCI-validated P2PE hardware terminals | ~33 | Retail using validated P2PE devices |
| SAQ D (Merchant) | All other merchants not qualifying for above types | ~329 | Merchants storing CHD, complex environments |
| SAQ D (SP) | Service providers storing, processing, or transmitting CHD | ~329 | Payment gateways, hosting providers |
Explore Individual SAQ Guides
Once you have determined which SAQ applies to your organization, dive deeper into the specific requirements and compliance guidance for your SAQ type.
Start Your SAQ Assessment with GRCTrack
GRCTrack automates SAQ type selection and walks you through every applicable requirement with guided workflows, evidence collection, and QSA-built compliance intelligence.