PCI DSS SAQ D for Service ProvidersSupported in OneClickComply

Complete your SAQ D-SP with evidence that stays current

SAQ D for Service Providers (SAQ D-SP) is the PCI DSS v4.0.1 self-assessment questionnaire that eligible service providers complete, together with an Attestation of Compliance, to validate their PCI DSS compliance. It covers all 12 PCI DSS requirements plus Appendices A1 and A2, including the requirements that apply only to service providers. Unlike merchants, service providers have no shorter SAQ to choose from.

See the SAQ D-SP requirements

SAQ D-SP Aligned

Automated Evidence

OneClickFix Enabled

Continuous Monitoring

In-House Audit Team

Who needs SAQ D-SP

Is SAQ D-SP right for your organisation?

Any service provider that stores, processes or transmits cardholder data on behalf of others, or can affect the security of that data, and that a payment brand defines as eligible to self-assess. This typically includes payment gateways, hosting and cloud providers, managed service providers and other third parties whose merchant or acquirer customers ask for proof of PCI DSS compliance. Service providers above the payment brands' self-assessment thresholds usually need a Report on Compliance from a QSA instead.

It is usually required by customers, partners or schemes rather than by law.

Issued by: PCI Security Standards Council (PCI SSC)
Latest version: SAQ D for Service Providers for PCI DSS v4.0.1, Revision 2 (January 2025)
Eligibility: All service providers that a payment brand defines as eligible to self-assess; it is the only SAQ option for service providers
Structure: Section 1 Assessment Information, Section 2a Reviewed Environment, Section 2b questionnaire, Section 3 Validation and Attestation
Output: Completed SAQ and Attestation of Compliance for Service Providers, plus ASV scan reports where requested
Submitted to: The organisation that requests it, such as a payment brand, acquirer or customer
Requirement basis: Contractual, through payment brand and acquirer compliance programmes
Type: Standard (contractual)
Region: Global
In OneClickComply: Supported today

How we help

OneClickComply makes it simple

OneClickComply maps SAQ D for Service Providers in its control library, and support is available on request. Evidence for the requirements is collected automatically from your connected cloud, identity and device tools, with continuous monitoring flagging control drift between annual attestations. Our in-house audit team can review your scoping, Not Applicable responses and service provider requirements before you sign the AOC.

Requirements covered

Section 2b of the SAQ follows the 12 PCI DSS v4.0.1 requirements and their sub-requirements, plus Appendix A1 for multi-tenant service providers and Appendix A2 for SSL/early TLS POI connections, with service provider-only requirements such as 8.3.10, 11.4.6, 12.4.2, 12.5.2.1 and 12.9.

Already working towards another framework?

ISO 2700124% of SAQ D-SP overlaps
SOC 287% of SAQ D-SP overlaps
NIST CSF70% of SAQ D-SP overlaps
GDPR21% of SAQ D-SP overlaps

Evidence you collect once counts towards every framework it applies to.

Manual SAQ D-SP vs. OneClickComply

Manual SAQ D-SP

Answering every applicable PCI DSS requirement in one long questionnaire with no shorter SAQ to fall back on
Writing 'Describe Results' entries for each requirement from evidence scattered across tools
Tracking service provider-only duties such as six-monthly scope confirmation and quarterly reviews
Rebuilding network diagrams, ASV scan records and policies before each annual attestation
Answering the same PCI questions again in every customer security questionnaire

With OneClickComply

One control set maps every SAQ D-SP requirement, so nothing applicable is missed
Evidence collected automatically from connected systems supports each requirement response
Continuous monitoring and alerts keep recurring service provider tasks on schedule
Policies, records and evidence stay current all year, not just before the AOC is signed
Security questionnaire automation and a trust centre reuse your PCI evidence for customers

Capabilities

Everything you need for SAQ D-SP

SAQ D-SP requirements mapped to shared controls, so evidence also counts towards ISO 27001 and SOC 2

Automated evidence collection for access, logging, configuration and vulnerability requirements

OneClickFix for supported misconfigurations, with each fix logged as evidence

AutoComplete policies covering Requirement 12 and the 'processes and mechanisms' sub-requirements

Vendor risk management and a trust centre to share PCI DSS status with customers

Ask an Auditor guidance on scoping, Not Applicable responses and service provider-only requirements

How it works

Three steps to SAQ D-SP compliance

Connect & scan

Connect your cloud, identity and SaaS tools. OneClickComply checks them against SAQ D-SP and shows you exactly where you stand.

Fix & generate

OneClickFix remediates technical gaps in one click, and AutoComplete generates SAQ D-SP-aligned policies from your real environment.

Monitor & evidence

Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.

Requirements

PCI DSS SAQ D for Service Providers requirements

The 12 PCI DSS v4.0.1 requirements and their sub-requirement groups as assessed in SAQ D for Service Providers, plus Appendices A1 and A2; Appendix A3 (DESV) is reported separately.

Reference	Requirement
Requirement 1	Install and Maintain Network Security Controls
1.1	Processes and mechanisms for installing and maintaining network security controls are defined and understood
1.2	Network security controls (NSCs) are configured and maintained
1.3	Network access to and from the cardholder data environment is restricted
1.4	Network connections between trusted and untrusted networks are controlled
1.5	Risks to the CDE from computing devices that can connect to both untrusted networks and the CDE are mitigated
Requirement 2	Apply Secure Configurations to All System Components
2.1	Processes and mechanisms for applying secure configurations to all system components are defined and understood
2.2	System components are configured and managed securely
2.3	Wireless environments are configured and managed securely
Requirement 3	Protect Stored Account Data
3.1	Processes and mechanisms for protecting stored account data are defined and understood
3.2	Storage of account data is kept to a minimum
3.3	Sensitive authentication data (SAD) is not stored after authorisation
3.4	Access to displays of full PAN and ability to copy PAN are restricted
3.5	Primary account number (PAN) is secured wherever it is stored
3.6	Cryptographic keys used to protect stored account data are secured
3.7	Key-management processes covering the full key lifecycle are defined and implemented where cryptography protects stored account data
Requirement 4	Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks
4.1	Processes and mechanisms for protecting cardholder data with strong cryptography during transmission are defined and understood
4.2	PAN is protected with strong cryptography during transmission
Requirement 5	Protect All Systems and Networks from Malicious Software
5.1	Processes and mechanisms for protecting all systems and networks from malicious software are defined and understood
5.2	Malicious software (malware) is prevented, or detected and addressed
5.3	Anti-malware mechanisms and processes are active, maintained, and monitored
5.4	Anti-phishing mechanisms protect users against phishing attacks
Requirement 6	Develop and Maintain Secure Systems and Software
6.1	Processes and mechanisms for developing and maintaining secure systems and software are defined and understood
6.2	Bespoke and custom software are developed securely
6.3	Security vulnerabilities are identified and addressed
6.4	Public-facing web applications are protected against attacks
6.5	Changes to all system components are managed securely
Requirement 7	Restrict Access to System Components and Cardholder Data by Business Need to Know
7.1	Processes and mechanisms for restricting access by business need to know are defined and understood
7.2	Access to system components and data is appropriately defined and assigned
7.3	Access to system components and data is managed via an access control system(s)
Requirement 8	Identify Users and Authenticate Access to System Components
8.1	Processes and mechanisms for identifying users and authenticating access are defined and understood
8.2	User identification and related accounts are strictly managed throughout an account's lifecycle
8.3	Strong authentication for users and administrators is established and managed
8.4	Multi-factor authentication (MFA) is implemented to secure access into the CDE
8.5	Multi-factor authentication (MFA) systems are configured to prevent misuse
8.6	Use of application and system accounts and associated authentication factors is strictly managed
Requirement 9	Restrict Physical Access to Cardholder Data
9.1	Processes and mechanisms for restricting physical access to cardholder data are defined and understood
9.2	Physical access controls manage entry into facilities and systems containing cardholder data
9.3	Physical access for personnel and visitors is authorised and managed
9.4	Media with cardholder data is securely stored, accessed, distributed, and destroyed
9.5	Point-of-interaction (POI) devices are protected from tampering and unauthorised substitution
Requirement 10	Log and Monitor All Access to System Components and Cardholder Data
10.1	Processes and mechanisms for logging and monitoring all access are defined and understood
10.2	Audit logs are implemented to support detection of anomalies and forensic analysis of events
10.3	Audit logs are protected from destruction and unauthorised modifications
10.4	Audit logs are reviewed to identify anomalies or suspicious activity
10.5	Audit log history is retained and available for analysis
10.6	Time-synchronisation mechanisms support consistent time settings across all systems
10.7	Failures of critical security control systems are detected, reported, and responded to promptly
Requirement 11	Test Security of Systems and Networks Regularly
11.1	Processes and mechanisms for regularly testing security of systems and networks are defined and understood
11.2	Wireless access points are identified and monitored, and unauthorised wireless access points are addressed
11.3	External and internal vulnerabilities are regularly identified, prioritised, and addressed
11.4	External and internal penetration testing is regularly performed and exploitable weaknesses are corrected
11.5	Network intrusions and unexpected file changes are detected and responded to
11.6	Unauthorised changes on payment pages are detected and responded to
Requirement 12	Support Information Security with Organizational Policies and Programs
12.1	A comprehensive information security policy is known and current
12.2	Acceptable use policies for end-user technologies are defined and implemented
12.3	Risks to the cardholder data environment are formally identified, evaluated, and managed
12.4	PCI DSS compliance is managed
12.5	PCI DSS scope is documented and validated
12.6	Security awareness education is an ongoing activity
12.7	Personnel are screened to reduce risks from insider threats
12.8	Risk to information assets associated with third-party service provider (TPSP) relationships is managed
12.9	Third-party service providers (TPSPs) support their customers' PCI DSS compliance
12.10	Suspected and confirmed security incidents that could impact the CDE are responded to immediately
Appendix A1	Additional PCI DSS Requirements for Multi-Tenant Service Providers
A1.1	Multi-tenant service providers protect and separate all customer environments and data
A1.2	Multi-tenant service providers facilitate logging and incident response for all customers
Appendix A2	Additional PCI DSS Requirements for Entities using SSL/Early TLS for Card-Present POS POI Terminal Connections
A2.1	POI terminals using SSL and/or early TLS are not susceptible to known SSL/TLS exploits

Always check the official SAQ D-SP text for the exact wording.

SAQ D-SP FAQs

What is SAQ D for Service Providers?

SAQ D for Service Providers is the PCI DSS self-assessment questionnaire that eligible service providers use to validate compliance. Published by the PCI Security Standards Council, the current version aligns with PCI DSS v4.0.1. It includes an Attestation of Compliance, a section describing the reviewed environment, and a questionnaire covering all 12 PCI DSS requirements plus Appendices A1 and A2, including requirements that apply only to service providers.

Who can use SAQ D for Service Providers?

SAQ D for Service Providers applies to all service providers that a payment brand defines as eligible to complete a self-assessment questionnaire. It is the only SAQ option for service providers, so they cannot use the shorter merchant SAQs such as SAQ A or SAQ B. Service providers that do not meet the brands' self-assessment criteria, usually because of transaction volume, must instead be assessed by a QSA and receive a Report on Compliance.

What is the difference between SAQ D for Merchants and SAQ D for Service Providers?

SAQ D for Service Providers includes the requirements that apply only to service providers, which SAQ D for Merchants omits. Examples include detecting failures of critical security control systems (10.7.1), six-monthly segmentation testing, quarterly reviews of personnel following security tasks, and Requirement 12.9 on supporting customers' PCI DSS compliance. The service provider version also adds Section 2a for environment details, such as network diagrams and ASV scan records, and asks for a description of testing results for each requirement.

What happens if a service provider is not PCI DSS compliant?

Consequences are set contractually by the payment brands, acquirers and customers rather than by law. A service provider that cannot show PCI DSS compliance may lose customers who need compliant providers under Requirement 12.8, or face fees or penalties under payment brand programmes. PCI SSC does not set fines itself, so the exact consequences depend on the relevant contracts and brand rules.

How do you complete SAQ D for Service Providers?

Start by confirming your eligibility and scoping your cardholder data environment correctly. Then assess the environment against every PCI DSS requirement, recording In Place, In Place with CCW, Not Applicable, Not Tested or Not in Place for each, and describe the results of your testing. Complete Sections 1, 2a, 2b and 3, sign the Attestation of Compliance, and submit it with any requested documents, such as ASV scan reports.

How does SAQ D for Service Providers relate to ISO 27001 and SOC 2?

ISO 27001 and SOC 2 do not replace SAQ D for Service Providers, but they overlap heavily with it. Access control, logging, vulnerability management, incident response and supplier management appear in all three. PCI DSS is more prescriptive, with specific technical requirements such as quarterly ASV scans, MFA into the CDE and payment page change detection. Mapping one control set across all three avoids collecting the same evidence several times.

How long does SAQ D for Service Providers take to complete?

It depends on the size of your cardholder data environment and how mature your controls are. SAQ D for Service Providers is the longest SAQ, covering every applicable PCI DSS requirement, and some requirements need evidence gathered over time, such as quarterly ASV scans and periodic reviews. Organisations starting from scratch should plan for remediation and evidence collection before the questionnaire itself can be completed accurately.

Does OneClickComply support SAQ D for Service Providers?

Yes, on request. SAQ D for Service Providers is mapped in OneClickComply's control library and available on request rather than enabled by default. Once enabled, OneClickComply collects evidence automatically from connected tools, generates policies, monitors controls for drift and gives you access to an in-house audit team. OneClickComply does not issue PCI DSS attestations; you sign the AOC as the assessed entity.

Related standards

All standards

Get SAQ D-SP ready, not stressed

Automate controls, gather evidence continuously and stay audit-ready, all on one platform.