PCI DSS SAQ D for Merchants and Service Providers

SAQ D for Merchants

Examples of environments where SAQ D may apply (from the SAQ Instructions):

• E-commerce merchants that accept account data on their website
• Merchants with electronic storage of account data
• Merchants that do not store account data electronically but do not meet another SAQ type
• Merchants that might meet another SAQ type but have additional PCI DSS requirements applicable to their environment

SAQ D for Service Providers

For PCI DSS v4.x, SAQ D for Service Providers requires additional documentation in Section 2a and specifies that service providers Describe Results for each PCI DSS requirement - a higher reporting bar than many merchant SAQs.

SAQ D vs ROC

SAQ D remains a self-attested questionnaire plus AOC. A ROC is a detailed assessment report, typically produced with a QSA when your compliance program requires it. See ROC and AOC and SAQ vs ROC.

How CyberSilo Helps

• Full-requirement evidence automation via CSA and ThreatHawk
• Gap assessment before choosing SAQ D vs ROC
• Continuous control monitoring so annual SAQ D is not a once-a-year scramble

Frequently Asked Questions

Is SAQ D the same for merchants and service providers?

Same family, different documents and expectations. The service provider version adds Describe Results and Section 2a documentation.

If I store PAN, can I still use SAQ A?

No. SAQ A forbids electronic store, process, or transmit of account data on merchant systems. Storage typically points to SAQ D (or a ROC if required).

Does SAQ D include all 12 requirements?

It is the comprehensive SAQ aligned to applicable PCI DSS requirements for that entity type - treat it as the full self-assessment path, not a reduced SAQ A-style subset.

Related PCI Resources

SAQ selector · SAQ types · SAQ A · ROC and AOC · QSA vs ISA vs ASV · 12 requirements