PCI DSS SAQ C-VT Explained

When SAQ C-VT typically fits

Virtual terminal via browser on an internet-isolated device, no CHD storage — confirm C-VT criteria.

Pitfalls

• Using the same PC for email/browsing breaks isolation assumptions
• Plugins and password managers can expand risk

Evidence habits

Keep network diagrams, CHD flow docs, and ASV/scan evidence aligned to the SAQ you claim. Log monitoring for in-scope systems still matters where the SAQ requires it.

How CyberSilo Helps

• Evidence mapping in CyberSilo CSA
• Detection and logging proof with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Can our QSA force a different SAQ?

Acquirers/brands and QSAs may require a more comprehensive SAQ if eligibility is unclear.

Does SAQ replace ROC?

SAQs are for eligible self-assessing entities; Level 1 merchants typically need ROC.

Version?

Use the SAQ version matching your DSS version (v4.x).

Related Resources

• PCI hub
• Merchant levels
• Standards family