Complete SAQ A with confidence and keep your payment pages secure

SAQ A is a PCI DSS self-assessment questionnaire for card-not-present merchants that fully outsource all cardholder data functions to PCI DSS compliant third parties. Published by the PCI Security Standards Council, the current SAQ A for PCI DSS v4.0.1 (Revision 1, January 2025) contains 27 requirements. Merchants answer each requirement, then sign an Attestation of Compliance for their acquirer or payment brand.

You are eligible for SAQ A if you accept only card-not-present payments, outsource all account data processing to a PCI DSS compliant provider, and never store, process or transmit card data electronically. Any card data kept must be on paper not received electronically. E-commerce merchants must also confirm all payment page elements come directly from the provider and that their site is not susceptible to script attacks.

SAQ A Revision 1, published in January 2025, removed requirements 6.4.3 (payment page script management), 11.6.1 (payment page change and tamper detection) and 12.3.1 (targeted risk analysis). In their place, the PCI Security Standards Council added an eligibility criterion: e-commerce merchants must confirm that their site is not susceptible to attacks from scripts that could affect their e-commerce systems.

SAQ A applies when every element of the payment page is delivered directly by a PCI DSS compliant provider, for example through a full redirect or iframe. SAQ A-EP applies to e-commerce merchants whose own website affects the security of the transaction without receiving card data, such as direct post or JavaScript forms. SAQ A-EP contains many more requirements because the merchant site is more exposed.

Yes, for e-commerce merchants. SAQ A includes requirement 11.3.2, which requires external vulnerability scans at least once every three months by a PCI SSC Approved Scanning Vendor, and 11.3.2.1, which requires scans after any significant change. These apply to the merchant server hosting the redirect mechanism or embedded payment form, not to the payment provider's systems.

PCI DSS is enforced contractually through your merchant agreement, not by law. If you fail to validate compliance, your acquirer or the payment brands can apply penalties, raise fees or restrict your ability to take card payments, and a breach can lead to further costs. The exact consequences depend on your acquirer's terms, so check your agreement.

SAQ A is separate from ISO 27001 and UK GDPR, but the controls overlap. Access management, patching, supplier oversight and incident response appear in all three. Outsourcing payments under SAQ A does not remove your UK GDPR duties for other personal data. OneClickComply maps one set of controls across frameworks, so evidence collected once counts towards each standard it applies to.

PCI DSS SAQ A is mapped in OneClickComply's control library and available on request. We can help you collect evidence for the 27 requirements, manage your payment provider as a vendor and generate supporting policies. OneClickComply does not issue PCI DSS validation: you complete and sign the SAQ and Attestation of Compliance yourself for your acquirer.