I run a small business with a Prestashop e-commerce website that sends customers to Sagepay to make a payment using the Presto Chango Sagepay payment module.
In my office I also have a one PC connected to the DMZ interface of our pfsense edge/outer firewall. Nothing else is connected to the DMZ network and all ports out are controlled with nothing being allowed in. This single PC runs Linux and is used to access the Sagepay virtual terminal via a web browser; to manually enter card payment details that are take over the telephone. Very occasionally, we also use the virtual terminal to enter card details given to us in person by a card holder.
In total we probably do not more that £150,000 of card payment transactions per year.
So far I have been using SAQ-C-VT, but I have never been sure that this is the correct form to use.
It is difficult for a small business to get good non-conflicting information on PCI DSS. Therefore, does anyone have a view on the correct SAQ form that we should be using?