Which SAQ form do I use for PCI DSS compliance?

Question

I run a small business with a Prestashop e-commerce website that sends customers to Sagepay to make a payment using the Presto Chango Sagepay payment module.

In my office I also have a one PC connected to the DMZ interface of our pfsense edge/outer firewall. Nothing else is connected to the DMZ network and all ports out are controlled with nothing being allowed in. This single PC runs Linux and is used to access the Sagepay virtual terminal via a web browser; to manually enter card payment details that are take over the telephone. Very occasionally, we also use the virtual terminal to enter card details given to us in person by a card holder.

In total we probably do not more that £150,000 of card payment transactions per year.

So far I have been using SAQ-C-VT, but I have never been sure that this is the correct form to use.

It is difficult for a small business to get good non-conflicting information on PCI DSS. Therefore, does anyone have a view on the correct SAQ form that we should be using?

Answer 1

Only a QAS can given you a qualified answer to your question, and it's probably worth a few hours consulting time to make sure you have the right scope, but I can give my view anyway.

So yes if you are inputting credit card data one at time then you need SAQ C VT as you say.

You also would need an SAQ to cover your e-commerce system, a quick search shows you have to host presta shop yourself but Sagepay is PCI compliant. If it's a full page redirect to Sagepay or an iFrame, then SAQ A should apply to you.

I think you can either do them separately or combine them in SAQ D and exclude the non-applicable requirements.

Good luck!