{"head":{"title":"What Is a PCI SAQ (Self-Assessment Questionnaire)?","description":"A PCI SAQ is the form merchants and service providers use to report their own PCI DSS assessment. Why there are several types, which applies and mistakes.","canonical":"https://oceanlab.in/glossary/saq"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"SAQ","path":"/glossary/saq"}],"slug":"saq","term":"SAQ (self-assessment questionnaire)","aka":["PCI SAQ","self-assessment questionnaire"],"category":"Payments and fintech","short":"The PCI DSS form that eligible merchants and service providers use to document the results of their own assessment.","body":[["The PCI SSC describes the SAQ as a reporting tool used to document self-assessment results from an entity's PCI DSS assessment. Businesses that are not required to have an assessor's Report on Compliance usually complete one, then sign an ",{"href":"/glossary/aoc","text":"AOC"},"."],["There are several SAQ types, each for a different way of taking cards. Which one fits depends on your ",{"href":"/glossary/pci-scope","text":"PCI scope"},". The shortest, SAQ A, is aimed at e-commerce merchants that hand all card handling to a third-party provider, for example through a redirect or an embedded payment iframe, and the PCI SSC publishes FAQs on its eligibility rules, including for scripts on payment pages."]],"why":["The SAQ type sets how much security work a business must do and prove. Product decisions, such as using hosted payment fields or building your own card form, can move a business from a short SAQ to a long one. Acquirers and payment providers usually ask for it each year."],"example":["An online shop uses a payment provider's hosted checkout page, so card data never touches its servers. It qualifies for the shortest SAQ type. When it later adds its own card form for a faster checkout, its scope grows and it needs a much longer SAQ."],"inBuild":["Picking the payment integration in a build is, in effect, picking the client's SAQ type. That trade-off belongs in discovery, not after launch."],"mistakes":[["Choosing the SAQ type by habit instead of by the actual payment flow."],["Ignoring scripts on the payment page, which the SAQ A rules now address."],["Treating the SAQ as a yearly form instead of a description of controls that must stay true all year."]],"related":[{"href":"/glossary/aoc","label":"AOC (attestation of compliance)","detail":"The official PCI SSC form a merchant or service provider signs to attest to the results of its PCI DSS assessment."},{"href":"/glossary/pci-scope","label":"PCI scope","detail":"Every system, person and process that PCI DSS applies to, because it handles card data or can reach systems that do."},{"href":"/glossary/cardholder-data-environment","label":"Cardholder data environment (CDE)","detail":"The people, processes and systems that store, process or transmit payment card data, plus the systems connected to them."},{"href":"/glossary/tokenization","label":"Tokenization (payments)","detail":"Replacing a card number or other sensitive value with a stand-in token that cannot be turned back into the original without the token service."}],"tools":[{"href":"/tools/pci-dss-saq-picker","label":"PCI DSS SAQ picker","detail":"Free tool"}],"links":[{"href":"/compliance/pci-dss","label":"PCI DSS guide","detail":"Card data rules and how to shrink your scope."},{"href":"/software/payments","label":"Software for payments","detail":"Payment systems and the compliance work they bring."}],"sources":[{"title":"PCI Security Standards Council glossary","url":"https://www.pcisecuritystandards.org/glossary/","checkedAt":"2026-10-25"},{"title":"PCI SSC FAQ: SAQ A eligibility criteria for scripts","url":"https://www.pcisecuritystandards.org/faqs/how-does-an-e-commerce-merchant-meet-the-saq-a-eligibility-criteria-for-scripts/","checkedAt":"2026-10-25"},{"title":"PCI SSC document library (PCI DSS and SAQs)","url":"https://www.pcisecuritystandards.org/document_library/","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}