Which SAQ type should I use?

Choose the SAQ variant that matches your payment processing model and merchant environment; if you outsource all card processing to validated third parties, a shorter SAQ type may apply, but confirm with your acquirer first.

Is the SAQ legally binding?

The SAQ is an attestation of controls and fact; while not a statute, it is relied on by acquirers and card brands and can trigger contractual or financial consequences if inaccurate.

Yes. Electronic signatures that demonstrate intent, consent, attribution, and record retention meet legal validity under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted.

How long should supporting evidence be retained?

Retain logs, scan results, and configuration snapshots for the audit period specified by your acquirer; follow federal and industry minima such as IRS and HIPAA where relevant.

What if my SAQ finds noncompliant items?

Document remediation steps, target dates, and compensating controls; notify your acquirer if required and schedule retesting to demonstrate closure.

Who reviews and signs the SAQ?

An authorized officer, security lead, or designated control owner should review and sign the attestation to confirm factual accuracy and accountability for remediation.

Electronic Signature
Templates
Miscellaneous
PCI-DSS Self-Assessment Questionnaire

PCI-DSS Self-Assessment Questionnaire

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

PCI-DSS Self-Assessment Questionnaire

THIS AGREEMENT AND SELF-ASSESSMENT ("Agreement") is entered into between Merchant Name: and Assessor/Service Provider Name: .

WHEREAS, Merchant collects, stores, transmits or processes cardholder data in connection with payment card transactions and must evaluate compliance with applicable Payment Card Industry Data Security Standard (PCI-DSS) requirements; and

WHEREAS, Assessor has been engaged to conduct a self-assessment and to document Merchant's performance of PCI-DSS controls, produce this Self-Assessment Questionnaire (SAQ), and, where applicable, provide findings, compensating controls, and remediation recommendations.

WHEREAS, the parties agree that completion of this SAQ, associated attestations, and any payments or remediation obligations shall be governed by the terms set forth below.

1. Merchant and Contact Information

Primary Contact Name Contact Title Merchant Address Phone Email

2. SAQ Selection and Environment

Select the SAQ type that best describes Merchant's cardholder data environment and payment channels. If uncertain, describe environment in the field below.

SAQ A (e-commerce or mail/telephone-order, fully outsourced) SAQ A-EP (e-commerce with third-party payment processors but merchant controls some elements) SAQ C or C-VT (merchant-provided payment application or virtual terminal) SAQ D (all other environments) Describe Cardholder Data Environment and Payment Channels

3. Scope of Work

The Assessor will perform the following activities as part of the self-assessment and documentation deliverables. The parties acknowledge that this SAQ documents the Merchant's self-attestation and supporting evidence.

Scope of Work Description

4. PCI-DSS Controls Self-Assessment

For each control, indicate compliance status. If selecting No, provide compensating controls or remediation plan.

1.1. Are network boundaries defined and are firewalls configured to restrict inbound and outbound traffic?

Yes No N/A

2.1. Are vendor-supplied default accounts and passwords changed prior to system deployment?

Yes No N/A

3.1. Is cardholder data stored minimized and protected with appropriate cryptography where retained?

Yes No N/A

4.1. Is cardholder data encrypted when transmitted over open, public networks?

Yes No N/A

5.1. Are anti-virus/malware defenses deployed and maintained where applicable?

Yes No N/A

5. Remediation and Exceptions

Remediation Plan for Non-Compliant Items Approved Exceptions (if any)

6. Payment Terms

Assessor's fees for services rendered under this Agreement are payable in accordance with the schedule below.

Total Amount Due Payment Schedule Late Fee

7. Term and Termination

This Agreement commences on the Start Date and continues until the End Date or until earlier termination in accordance with this section.

Start Date End Date Notice Period for Termination (days)

8. Confidentiality

Each party shall hold in confidence and not disclose to any third party any Confidential Information of the other party, including but not limited to cardholder data, system configurations, and assessment findings, except as required by law. The receiving party shall use at least the same standard of care to protect Confidential Information as it uses to protect its own confidential information, but in no event less than reasonable care.

Confidentiality obligations with respect to cardholder data and assessment findings shall survive termination of this Agreement for a period of five (5) years or for the maximum period permitted by applicable law, whichever is longer.

9. Attestation of Compliance

The Merchant representative attests, under penalty of perjury and to the best of his or her knowledge, that the answers provided in this SAQ accurately represent the Merchant's cardholder data environment and the Merchant's compliance status as of the date of signature below.

Attestation Merchant attests that responses are true and accurate as of the signature date.

10. Governing Law and Entire Agreement

This Agreement shall be governed by and construed in accordance with the substantive laws of the state or jurisdiction indicated by the Merchant in writing. Any disputes arising under this Agreement shall be resolved in the courts of that jurisdiction unless the parties agree otherwise in writing.

This Agreement, including the completed SAQ, attestation and any appendices signed by the parties, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior negotiations, understandings and agreements between the parties.

11. Certifications and Acknowledgments

Merchant certifies that it will implement remediation activities in a timely manner for any non-conformities identified and will retain evidence of corrective actions and monitoring as required for future assessments and audits.

Evidence Retention Location Additional Comments

Merchant Representative

Printed Name:

Signature:

Date:

Assessor / Service Provider

Printed Name:

By:

Date:

What the PCI-DSS Self-Assessment Questionnaire Covers

The PCI-DSS Self-Assessment Questionnaire (SAQ) is a standardized, vendor-neutral checklist that helps merchants and service providers evaluate their compliance with the Payment Card Industry Data Security Standard. It documents control scope, implementation status, and compensating controls for cardholder data environments where full on-site audits are not required. SAQ completion varies by merchant type and processing model and may be required annually by acquiring banks or card brands. The SAQ is a reporting tool, not a substitute for technical remediation or external vulnerability scanning where applicable.

Why Completing an Accurate SAQ Matters

Completing the PCI-DSS SAQ documents your cardholder data controls, demonstrates due diligence to acquirers and brands, and identifies gaps that reduce breach risk. Accurate SAQs support risk management, insurance discussions, and vendor oversight while preserving merchant ability to accept card payments.

Who Typically Completes a PCI-DSS SAQ

Organizations filled out SAQs when they accept, process, or store cardholder data but do not require a full QSA-led on-site assessment.

Small merchants and online retailers that outsource payment processing and need to confirm reduced scope controls.
Internal compliance teams at mid-market companies responsible for annual attestation and vendor controls.
Managed service providers and SaaS vendors who handle card transactions indirectly and must confirm segmentation.

The SAQ is often completed by someone with knowledge of IT, payment flows, and security controls; final submission may require approval by legal, operations, or the acquiring bank.

Who Signs and Owns the SAQ

CISO

Chief Information Security Officer or equivalent typically reviews and signs attestations for larger merchants, certifying that technical and administrative controls are in place and that the SAQ reflects the current cardholder data environment.

Controller

A senior operations or finance executive may sign for small businesses or merchants where IT is outsourced; signature attests to control ownership and financial responsibility for remediation.

Essential Data Elements in the SAQ

Merchant ID: MID number

Payment Channels: Card-not-present, in-person

Scope Definition: Systems in-scope

Control Status: Implemented/Not

Compensating Controls: Documented reasons

Attestation Date: MM/DD/YYYY

Common Preparation Pitfalls to Avoid

Underestimating scope by excluding systems that touch cardholder data results in incomplete attestations and potential noncompliance.
Relying solely on third-party statements without verifying segmentation and contractual responsibilities can leave gaps.
Using outdated SAQ versions or skipping quarterly external vulnerability scans when required will trigger findings.
Documenting controls without operational evidence—logs, configurations, or access reviews—results in failed attestations.

How to Complete the SAQ, Step by Step

Follow a logical sequence: define scope, gather evidence, answer control questions, document compensating controls, and obtain required signatures.

01

Define scope: Map systems, flows, and third parties that touch card data.
02

Collect evidence: Export logs, configurations, and vendor contracts supporting answers.
03

Complete questions: Answer each control with factual evidence or documented compensating controls.
04

Sign and retain: Obtain authorized signatures and save the completed SAQ securely.

Where the SAQ Fits in Your Compliance Workflow

An SAQ is one element of an annual compliance cycle that includes scans, remediation, and attestation to your acquirer.

Initiate assessment: Trigger SAQ after network or payment changes.
External scanning: Schedule ASV scans if required by the SAQ type.
Remediate findings: Track fixes, retest, and close issues.
Attest annually: Submit SAQ and evidence to acquirer if requested.

Typical Online SAQ Workflow Settings

Configure your online workflow to capture evidence, route approvals, and retain signed attestations for auditors and acquirers.

Form field name and intended use	Configuration or expected input
Authentication method	Email link, SMS code, or SSO
Evidence attachments	PDF logs, config exports accepted
Approval routing	Sequential or parallel approvers
Retention policy	Store signed SAQ for required period

Technical Considerations for eSubmission

Choose a platform that supports secure uploads, multi-signer workflows, and an immutable audit trail for SAQ submissions.

File types: PDF, DOCX, CSV supported
Authentication: Email OTP or SSO
Integrations: CRMs and cloud storage

Ensure the platform encrypts data in transit and at rest and provides exportable audit logs so you can produce evidence for acquirers or auditors when required.

Key Timing Expectations for PCI-DSS SAQs

Timing depends on acquirer and card brand requirements; common expectations cover annual attestation and periodic scanning or retesting.

Annual Attestation Deadline:

SAQs are typically required annually by your acquiring bank.

Quarterly Scans:

External vulnerability scans occur quarterly when required.

Remediation Window:

Acquirers often expect remediation within 30–90 days.

Change-triggered Review:

Significant network or payment changes prompt a scope review.

Evidence Retention:

Retain supporting artifacts for the audit period requested.

Consequences of Incomplete or Incorrect SAQs

Fines and Assessments: Monetary penalties

Account Termination: Loss of merchant services

Forensic Audit: Third-party investigation costs

Higher Fees: Increased PCI compliance costs

Reputational Harm: Customer trust erosion

Legal Exposure: Regulatory or civil claims

What a Complete SAQ Should Include

A professional SAQ documents scope, answers to control statements, compensating control rationale, evidence, signatures, and retention plans.

Scope statement

Clear description of systems, networks, and third parties that are in scope and the methods used to segment cardholder data environments from out-of-scope systems.

Control responses

Direct answers to each PCI-DSS question, noting whether the control is implemented, partially implemented, not applicable, or replaced by a compensating control.

Compensating controls

Documented justification, risk assessment, and compensating measures when standard controls are not feasible, including evidence supporting the compensating approach.

Evidence index

Indexed attachments (logs, screenshots, configuration files, vendor letters) mapped to each control item for rapid auditor review.

Authorized attestation

Signatory block for an authorized officer certifying the accuracy of the SAQ and confirming ongoing maintenance of documented controls.

Retention plan

Schedule for retaining the SAQ and supporting artifacts consistent with contractual and regulatory requirements and internal policy.

Key Milestones in a Typical SAQ Cycle

Map the SAQ cycle into milestones to coordinate scans, remediation, approvals, and annual attestation.

01

Scope Review

Identify systems and third parties that handle card data early in the cycle.

02

Quarterly Scanning

Run external ASV scans when required and document results.

03

Remediation Period

Address critical findings within the timeframe agreed with acquirer.

04

Final Attestation

Collect signatures and submit the completed SAQ to the acquirer.

Platform Pricing and Feature Comparison for eSignature and Evidence Workflows

Comparison of common eSignature vendors and plan-level starting prices to help estimate eSigning and document workflow costs for SAQ evidence collection.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	Yes, 7-day trial	No	No	No	No
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently Asked Questions About the PCI-DSS SAQ

Answers to common questions about scope, evidence, signatures, and retaining completed SAQs to help reduce errors and rework.

Need help? Contact support

Which SAQ type should I use?
Choose the SAQ variant that matches your payment processing model and merchant environment; if you outsource all card processing to validated third parties, a shorter SAQ type may apply, but confirm with your acquirer first.
Is the SAQ legally binding?
The SAQ is an attestation of controls and fact; while not a statute, it is relied on by acquirers and card brands and can trigger contractual or financial consequences if inaccurate.
Can I eSign the SAQ?
Yes. Electronic signatures that demonstrate intent, consent, attribution, and record retention meet legal validity under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted.
How long should supporting evidence be retained?
Retain logs, scan results, and configuration snapshots for the audit period specified by your acquirer; follow federal and industry minima such as IRS and HIPAA where relevant.
What if my SAQ finds noncompliant items?
Document remediation steps, target dates, and compensating controls; notify your acquirer if required and schedule retesting to demonstrate closure.
Who reviews and signs the SAQ?
An authorized officer, security lead, or designated control owner should review and sign the attestation to confirm factual accuracy and accountability for remediation.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now