SAQ (self-assessment questionnaire)
Also called PCI SAQ, self-assessment questionnaire.
The PCI DSS form that eligible merchants and service providers use to document the results of their own assessment.
Last updated
What it is.
The PCI SSC describes the SAQ as a reporting tool used to document self-assessment results from an entity's PCI DSS assessment. Businesses that are not required to have an assessor's Report on Compliance usually complete one, then sign an AOC.
There are several SAQ types, each for a different way of taking cards. Which one fits depends on your PCI scope. The shortest, SAQ A, is aimed at e-commerce merchants that hand all card handling to a third-party provider, for example through a redirect or an embedded payment iframe, and the PCI SSC publishes FAQs on its eligibility rules, including for scripts on payment pages.
Why it matters
The SAQ type sets how much security work a business must do and prove. Product decisions, such as using hosted payment fields or building your own card form, can move a business from a short SAQ to a long one. Acquirers and payment providers usually ask for it each year.
In a product build
Picking the payment integration in a build is, in effect, picking the client's SAQ type. That trade-off belongs in discovery, not after launch.
Common mistakes.
- 01
Choosing the SAQ type by habit instead of by the actual payment flow.
- 02
Ignoring scripts on the payment page, which the SAQ A rules now address.
- 03
Treating the SAQ as a yearly form instead of a description of controls that must stay true all year.
Read the official text.
Primary sources this definition is based on.
- PCI Security Standards Council glossarychecked 2026-10-25
- PCI SSC FAQ: SAQ A eligibility criteria for scriptschecked 2026-10-25
- PCI SSC document library (PCI DSS and SAQs)checked 2026-10-25
Work it out with a tool.
Related terms.
- AOC (attestation of compliance)The official PCI SSC form a merchant or service provider signs to attest to the results of its PCI DSS assessment.
- PCI scopeEvery system, person and process that PCI DSS applies to, because it handles card data or can reach systems that do.
- Cardholder data environment (CDE)The people, processes and systems that store, process or transmit payment card data, plus the systems connected to them.
- Tokenization (payments)Replacing a card number or other sensitive value with a stand-in token that cannot be turned back into the original without the token service.
Guides and pages
Browse the full glossary or read answers to common questions.
