PCI DSS SAQ Types Explained: A, A-EP, B, B-IP, C, C-VT, D, P2PE and SPoC

SAQ Types at a Glance

E-Commerce Quick Path

• No merchant payment-page code / fully outsourced host - often SAQ A.
• Merchant creates the payment form (Direct Post) or delivers payment scripts - SAQ A-EP.
• Accepts account data on own site or anything else - SAQ D.

Requirement counts from the SAQ Instructions table (v4.x): fully outsourced with no webpage access ~14*; URL redirect ~27*; iframe ~27*; Direct Post / merchant scripts - A-EP ~139; all other e-commerce - SAQ D (all applicable requirements). Asterisks refer to explanatory notes in SAQ A.

How CyberSilo Helps

• Compliance Standards Automation - evidence mapping for the applicable SAQ requirement set
• ThreatHawk SIEM - logging and monitoring evidence where Requirement 10 applies
• USA v4.0.1 readiness - SAQ selection workshops aligned with QSA and acquirer expectations

Frequently Asked Questions

Can I pick SAQ A because most of my volume is outsourced?

Only if you meet all SAQ A criteria for that channel. Mixed channels may need multiple SAQs or SAQ D.

Do service providers ever use SAQ A?

No. SAQ-eligible service providers use SAQ D for Service Providers only.

Is SPoC the same as P2PE?

No. Different PCI standards and listings (SPoC vs P2PE), and different eligibility and device models (COTS plus SCRP vs PTS POI in a P2PE solution).

Related PCI Resources

PCI DSS hub · SAQ selector · SAQ A · SAQ A-EP · SAQ D · ROC and AOC · SAQ vs ROC · 12 requirements