Which PCI SAQ do I need? The answer depends on how your business takes payments, not on how big you are. Answer 12 questions and the selector shows the Self-Assessment Questionnaire you probably need.
Zippie IT, a veteran-owned company in Meridian, Idaho, built this selector from the PCI SSC questionnaire eligibility rules so you can see what is ahead before you speak to your processor.
How to read your PCI SAQ result
Eligibility is all or nothing. If any one condition of a narrower questionnaire is not true for you, you move to a broader one. Your payment processor or acquirer decides which validation you must complete, so confirm the result with them.
Zippie IT is not a Qualified Security Assessor or an Approved Scanning Vendor. Our PCI DSS assessment shows you what to fix before you sign your own questionnaire.
Send us your result
Want help with the next steps? Your result is copied into the box below. Add your name, email and phone number and we will get back to you. Please do not include card numbers or patient information.
We use your details to respond to your request. If you want details, see our Privacy Policy.
Related services
Frequently asked questions
What is a PCI SAQ?
A Self-Assessment Questionnaire is the form most small businesses complete each year to show they protect card data. There are several types, such as A, B, C and D.
Which SAQ is the shortest?
SAQ A and SAQ P2PE are usually the shortest, for businesses that hand all card handling to a compliant provider or validated encrypted terminals.
Does using Square or Stripe make me exempt?
No, but it can make your questionnaire much shorter. A fully hosted checkout or validated encrypted terminal usually qualifies for a short SAQ.
Is this result final?
No. It is a guide. Your processor or acquirer decides what you must complete, and Zippie IT is not a QSA or ASV.
How often do I complete the SAQ?
Every year and after significant changes. External vulnerability scans, where your SAQ requires them, run every three months.