01
SAQ Eligibility Review
Review payment methods and likely eligibility for the relevant SAQ type.
PCI DSS SAQ Support
Use the Right PCI DSS SAQ and Make Sure the Answers Match Your Real Environment
The hardest part of a PCI DSS Self-Assessment Questionnaire is often confirming that your organisation is actually eligible for it and that the answers are supported by the way payments and systems really work.
2-sec helps eligible merchants and service providers review likely SAQ eligibility, define scope, interpret requirements and prepare the evidence behind the questionnaire.
SAQ Eligibility First
Do Not Start With the Questionnaire Start With the Payment Model
A PCI DSS Self-Assessment Questionnaire is a PCI SSC validation tool used by eligible merchants and service providers. Different SAQ types apply to different payment-processing environments and eligibility conditions.
PCI SSC advises organisations to confirm that they meet the eligibility criteria for the SAQ they intend to use and to confirm reporting expectations with the compliance-accepting entity.
SAQ Support
Help With the Decisions Behind the Form
2-sec can support the preparation process without turning the SAQ into a box-ticking exercise.
02
PCI Scope Review
Confirm systems, people, technologies and third parties affecting responses.
03
Requirement Interpretation
Explain what requirements mean in your environment.
04
Evidence Preparation
Identify the records that support each response.
05
Gap Identification
Flag controls or evidence that need remediation.
06
Attestation Preparation
Help ensure the final reporting reflects the actual assessed environment.
Common SAQ Routes
The Correct SAQ Depends on How You Accept Payments
These are directional only; eligibility must be checked against current PCI SSC criteria.
SAQ AEligible outsourced card-not-present environments meeting the specific criteria.
SAQ A-EPCertain ecommerce environments where the website can affect payment security.
SAQ BEligible imprint or standalone dial-out terminal environments.
SAQ B-IPEligible standalone PTS POI environments with IP connectivity.
SAQ C-VTEligible virtual-terminal environments.
SAQ CEligible internet-connected payment environments not fitting narrower SAQs.
SAQ P2PEEligible merchants using a validated PCI-listed P2PE solution.
SAQ DComprehensive SAQ for merchants or service providers not eligible for another SAQ.
How 2-sec Approaches It
A Better Way to Complete a PCI DSS SAQ
01
Confirm Reporting Requirement
Identify who receives your compliance evidence.
02
Validate SAQ Eligibility
Compare the payment environment with current eligibility criteria.
03
Define Scope
Map systems, people and third parties affecting the answers.
04
Assess and Gather Evidence
Review requirements and assemble support.
05
Remediate Gaps
Correct weaknesses before finalising.
06
Complete SAQ and Attestation
Finish the reporting package accurately.
The shortest SAQ is only useful if your environment genuinely qualifies for it.
Get Help With Your PCI SAQ ↗SAQ Questions
Frequently Asked Questions About PCI DSS SAQs
Which PCI DSS SAQ do I need?
It depends on payment channels, technology and outsourcing. Confirm the applicable reporting method with the entity receiving your compliance evidence.
Can 2-sec tell us which SAQ applies?
2-sec can review likely eligibility, but the compliance-accepting entity determines what it will accept.
Is SAQ A automatic if we outsource payments?
No. The specific SAQ A eligibility criteria still need to be satisfied.
Do ecommerce merchants using SAQ A still have website security responsibilities?
Yes. Current v4.x eligibility includes specific ecommerce considerations.
Can we change SAQ type after changing our payment architecture?
Potentially, if the new environment meets a different SAQ's eligibility criteria.
Continue Your PCI DSS Journey
Related PCI DSS Services
PCI DSS ScopingDefine the systems, people, locations and third parties that handle, transmit or store cardholder data — the environment the answers must reflect.PCI DSS Gap AnalysisIdentify control gaps, missing evidence and remediation priorities before you finalise the questionnaire and attestation.PCI QSA ServicesGet QSA-led assessment and advice for complex, multi-channel or service-provider environments where a SAQ is not the right route.