Which PCI DSS SAQ applies when you don't store store but transmit CHD?

Question

We have a merchant website that uses Authorize.net's AIM. Cardholder data (credit card number, expiration date, etc.) is entered at our website. Then it's transmitted to payment gateway and isn't stored at our servers.

Which PCI DSS SAQ applies to us? Which PCI DSS requirements should we conform to?

Answer 1

If your systems touch the cardholder data during transmission but you don't store any data, you will be an SAQ C.

For more guidance on determining you SAQ type, see the PCI DSS SAQ Instruction Guide v2.0 page 12, Selecting the SAQ and Attestation that Best Apply to Your Organization.