How do you prepare for a PCI level 2 self-assessment questionnaire (SAQ)?

2 How to choose the right SAQ?

There are different versions of the SAQ, depending on the way you accept and process card payments. For example, SAQ A is for merchants who use a third-party service provider to handle all cardholder data, while SAQ D is for merchants who store, process, or transmit cardholder data on their own systems. You need to choose the SAQ that matches your payment scenario and environment. You can use the PCI DSS SAQ Instructions and Guidelines document or consult with your acquirer or payment processor to help you select the right SAQ.

3 How to prepare your data and systems?

Before you start filling out the SAQ, you need to ensure that your data and systems are secure and compliant with PCI DSS. This requires you to identify the scope of your cardholder data environment (CDE), document the flow of cardholder data and the roles and responsibilities of each party, and implement the PCI DSS requirements for your CDE. This includes installing firewalls, encrypting data, restricting access, patching systems, and logging activities. You should also perform a network scan by an ASV to detect any vulnerabilities or misconfigurations in your CDE. Once any issues are resolved, you must obtain a passing scan report from the ASV.

4 How to fill out the SAQ?

Once you have prepared your data and systems, you can begin filling out the SAQ. It's important to read the instructions carefully and understand the terms and definitions used in the document. Then, answer each question truthfully and accurately. If you answer "No" or "Not Applicable" to any question, explain why or provide a compensating control. You should also attach evidence or documentation that supports your answers, such as policies, procedures, diagrams, screenshots, scan reports, or attestations. After that, review your answers to make sure they are consistent and complete. You may need to involve other staff members or external consultants to verify your answers or provide additional information. Finally, sign the attestation of compliance (AOC) at the end of the SAQ; this is a declaration that you have completed the SAQ and are compliant with PCI DSS.

5 How to submit the SAQ?

After you have filled out the SAQ, you need to submit it to your acquirer or payment processor. You may also need to submit it to other parties, such as your bank, your card brands, or your regulators. You need to follow the submission instructions and deadlines provided by each party. You also need to keep a copy of the SAQ and the supporting documents for your own records and reference.

6 How to maintain your compliance?

Maintaining compliance with PCI DSS does not end with completing the SAQ. You need to monitor and test your security controls regularly, updating them as necessary. Additionally, you must review and update your policies and procedures periodically, training your staff on them. If there are any changes in your payment scenario or environment, you must report them to your acquirer or payment processor to determine if a different SAQ or scan is required. Finally, you must respond to any requests or audits from your acquirer, payment processor, card brands, or regulators regarding your compliance status.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?