PCI DSS SAQ A: Full Outsourcing Eligibility, Script Criteria, and ASV Scans

Eligibility Criteria

Confirm all of the following for the payment channel:

• Accepts only card-not-present (e-commerce or MOTO) transactions
• All processing of account data entirely outsourced to a PCI DSS compliant TPSP/payment processor
• Merchant does not electronically store, process, or transmit any account data on merchant systems or premises
• Merchant confirmed TPSP(s) are PCI DSS compliant for the services used
• Any retained account data is on paper only and not received electronically
• E-commerce additionally: All elements of payment page(s)/form(s) delivered to the customer's browser originate only and directly from a PCI DSS compliant TPSP/payment processor
• E-commerce additionally: Merchant confirmed the site is not susceptible to script attacks affecting e-commerce system(s)

E-Commerce Methods That Can Fit SAQ A

• Fully hosted by a TPSP with no merchant webpage access
• URL redirect to a compliant TPSP
• iframe / embedded payment page or form from a compliant TPSP

Does not fit SAQ A: merchant creates the payment form (Direct Post); merchant delivers scripts that build or support the payment page - see SAQ A-EP.

Approximate applicable requirement counts from the SAQ Instructions table: no webpage access ~14*; redirect ~27*; iframe ~27* (* explanatory notes in SAQ A).

ASV Scanning in SAQ A

For redirect and iframe hosts, quarterly external ASV scans under 11.3.2 (and after significant change under 11.3.2.1) apply to the merchant system(s) hosting those pages. The PCI SSC ASV Resource Guide calls this out as a first-time SAQ A obligation for many merchants.

How CyberSilo Helps

• Evidence packs for remaining SAQ A controls
• Threat Exposure Management and ThreatHawk SIEM for vulnerability and change evidence
• Readiness reviews that check iframe vs redirect vs Direct Post before you lock the SAQ type

Frequently Asked Questions

Are 6.4.3 and 11.6.1 still in SAQ A?

No in the current SAQ A (January 2025 version effective 31 March 2025). They remain in PCI DSS and in broader SAQs such as A-EP and D. SAQ A uses the script-susceptibility eligibility criterion instead.

Does the script eligibility criterion apply to URL redirects?

Per the SSC FAQ, the new criterion applies to merchants with a webpage that includes a TPSP embedded payment page/form (iframe). It does not apply to pure redirects or fully outsourced payment with no merchant webpage involvement. Confirm with current FAQ/SAQ text and your acquirer.

Can a service provider use SAQ A?

No. SAQ A is not applicable to service providers.

Related PCI Resources

SAQ types · SAQ selector · SAQ A-EP · SAQ D · ASV scan requirements · Requirement 11 · SAQ vs ROC