Complete your SAQ C-VT and keep virtual terminal payments secure
SAQ C-VT is the PCI DSS Self-Assessment Questionnaire for merchants that take card payments only by manually typing card details, one transaction at a time, into a virtual payment terminal hosted by a PCI DSS compliant third party. The v4.0.1 version, published by the PCI Security Standards Council in October 2024, contains 54 requirements drawn from PCI DSS Requirements 1 to 9 and 12. It assumes the merchant uses an isolated computing device and stores no account data electronically.
Is SAQ C-VT right for your organisation?
SAQ C-VT suits shops and mail or telephone order merchants that enter card details into a web-based virtual terminal from a dedicated, segmented device with no card readers attached. It does not apply to e-commerce channels or service providers, and any account data kept must be on paper only. Your acquirer or payment brand decides whether you must validate, and confirms which SAQ you should file each year.
It is usually required by customers, partners or schemes rather than by law.
- Issued by
- PCI Security Standards Council
- Latest version
- SAQ C-VT for PCI DSS v4.0.1, published October 2024
- Number of requirements
- 54
- Applies to
- Merchants using only a third-party hosted virtual terminal on an isolated device
- Not for
- E-commerce channels and service providers
- Validation route
- Self-assessment with an Attestation of Compliance submitted to your acquirer or payment brand
- Enforced by
- Acquiring banks and payment brands through merchant agreements
- Type
- Standard (contractual)
- Region
- Global
- In OneClickComply
- Supported today
OneClickComply makes it simple
OneClickComply maps the 54 SAQ C-VT requirements in its control library and makes this questionnaire available on request, so you can evidence anti-malware, user access, MFA and policy controls alongside your other frameworks. Automated evidence collection, AutoComplete policies for Requirements 2, 3, 8, 9 and 12, and continuous monitoring of the device and accounts behind your virtual terminal reduce the manual work. Our in-house audit team can also help you confirm eligibility and scope before you attest.
Requirements covered
54 PCI DSS v4.0.1 requirements across Requirements 1 to 9 and 12, with no Requirement 10 or 11 items and Appendix A2 not used.
Manual SAQ C-VT vs. OneClickComply
- Working out whether your setup really meets the SAQ C-VT eligibility criteria
- Gathering screenshots of anti-malware, patching and password settings by hand
- Writing and annually reviewing security policies from blank templates
- Chasing your virtual terminal provider for its compliance status and responsibility split
- Rebuilding the same evidence from scratch for every annual attestation
- Expert help confirming eligibility and scope before you start
- Evidence collected automatically from your connected devices and identity tools
- Audit-ready policies generated from your real environment
- Vendor risk management that tracks service provider status and responsibilities
- Controls mapped once and reused for each year's SAQ and other frameworks
Everything you need for SAQ C-VT
SAQ C-VT requirements mapped in the control library, available on request
Eligibility and scoping guidance from our in-house audit team
Automated evidence for anti-malware, patching and user accounts on the terminal device
AutoComplete security, access and media handling policies for Requirements 2 to 12
Third-party service provider tracking for your virtual terminal provider
Continuous monitoring with alerts when MFA, malware or access controls drift
Three steps to SAQ C-VT compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against SAQ C-VT and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates SAQ C-VT-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
PCI DSS SAQ C-VT requirements
All 54 PCI DSS v4.0.1 requirements included in SAQ C-VT, listed by their PCI DSS requirement number with short descriptive titles.
| Reference | Requirement |
|---|---|
| 1.3.1 | Inbound traffic to the CDE is restricted |
| 1.3.2 | Outbound traffic from the CDE is restricted |
| 1.3.3 | Network security controls between wireless networks and the CDE |
| 1.5.1 | Security controls on devices connecting to untrusted networks and the CDE |
| 2.1.1 | Requirement 2 policies and procedures documented, current and in use |
| 2.2.2 | Vendor default accounts are managed |
| 2.2.4 | Only necessary services, protocols and functions are enabled |
| 2.2.5 | Insecure services, protocols or daemons are justified and secured |
| 2.2.6 | System security parameters are configured to prevent misuse |
| 2.2.7 | Non-console administrative access is encrypted |
| 2.3.1 | Wireless vendor defaults are changed or confirmed secure |
| 2.3.2 | Wireless encryption keys are changed when required |
| 3.1.1 | Requirement 3 policies and procedures documented, current and in use |
| 3.3.1 | Sensitive authentication data is not stored after authorisation |
| 3.3.1.2 | Card verification code is not stored after authorisation |
| 3.4.1 | PAN is masked when displayed |
| 4.2.1.2 | Wireless networks use strong cryptography for authentication and transmission |
| 5.2.1 | Anti-malware solution deployed on all system components |
| 5.2.2 | Anti-malware detects and removes, blocks or contains known malware |
| 5.3.1 | Anti-malware kept current via automatic updates |
Always check the official SAQ C-VT text for the exact wording.
SAQ C-VT FAQs
What is PCI DSS SAQ C-VT?
SAQ C-VT is a PCI DSS Self-Assessment Questionnaire for merchants whose only card processing in a channel is manually keying transactions into a virtual payment terminal hosted by a PCI DSS compliant third party. The v4.0.1 version, published in October 2024 by the PCI Security Standards Council, contains 54 requirements and is completed with an Attestation of Compliance submitted to your acquirer or payment brand.
Who is eligible for SAQ C-VT?
You are eligible if your only payment processing for the channel is a third-party hosted virtual terminal accessed through a web browser on a computing device isolated in a single location. The device must not store account data, must have no card readers attached, and you must not receive, transmit or store account data electronically elsewhere. Any retained account data must be on paper. E-commerce channels and service providers cannot use it.
What is the difference between SAQ C-VT and SAQ C?
SAQ C-VT is narrower than SAQ C. SAQ C-VT covers only manual keyboard entry into a hosted virtual terminal on an isolated device, while SAQ C covers merchants with payment application systems connected to the Internet, such as some point-of-sale setups. Because the virtual terminal environment is simpler, SAQ C-VT contains fewer requirements. Your acquirer can confirm which questionnaire matches your environment.
Does SAQ C-VT require ASV vulnerability scans?
No. The SAQ C-VT for PCI DSS v4.0.1 contains no Requirement 11 items, so external ASV scans are not part of the questionnaire itself. It does include vulnerability identification and patching under Requirements 6.3.1 and 6.3.3. Your acquirer or payment brand can still request additional documentation, so confirm their expectations before you submit.
Is SAQ C-VT mandatory?
SAQ C-VT is a contractual obligation rather than a law. Card brands and acquiring banks require merchants that accept card payments to validate PCI DSS compliance, and eligible virtual terminal merchants typically do this with SAQ C-VT. Failing to validate or suffering a breach can lead to fees, higher processing costs or loss of card acceptance under your merchant agreement.
How do I complete SAQ C-VT?
Start by confirming you meet every eligibility criterion and that your environment is properly scoped. Then assess each of the 54 requirements, marking each one In Place, In Place with CCW, Not Applicable or Not in Place, and complete the Attestation of Compliance. Finally submit the SAQ and AOC, with any other requested documents, to your acquirer or payment brand.
How does SAQ C-VT relate to ISO 27001?
SAQ C-VT and ISO 27001 overlap in areas such as security policy, access control, malware protection, supplier management and incident response. ISO 27001 certification does not replace PCI DSS validation, but evidence for shared controls can support both. Mapping controls once lets you reuse that evidence across the SAQ and your ISO 27001 management system.
Does OneClickComply support SAQ C-VT?
Yes, on request. SAQ C-VT is mapped in OneClickComply's control library and available on request rather than as a standard self-serve framework. Once enabled, you can use automated evidence collection, AutoComplete policies, vendor risk management and continuous monitoring for its requirements, with guidance from our in-house audit team. OneClickComply does not file or approve your attestation.
Related standards
All standards- PCI DSS v4.0.1Standard · Global
- PCI DSS SAQ D for Service ProvidersStandard · Global
- PCI DSS v4.0.1 SAQ D for MerchantsStandard · Global
- PCI DSS SAQ A-EPStandard · Global
- PCI DSS v4.0.1 SAQ CStandard · Global
- PCI DSS v4.0.1 SAQ B-IPStandard · Global
- PCI DSS SAQ AStandard · Global
- PCI DSS v4.0.1 SAQ BStandard · Global
Get SAQ C-VT ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.