PCI-DSS SAQ A is supposed to be signed off by the "Merchant Executive Officer". Who is that?

3 Answers 3


NOTE : not a QSA, but do have some PCI experience

The merchant executive officer is the officer of the company that has responsibility for compliance/regulatory matters. This is often the Chief Financial Officer, but could be a Chief Security Officer, Chief Technology Officer, even the Chief Executive Officer or Chief Operating Officer.

Who it is depends on the company, but it is likely the "C" level executive to whom the people who handle compliance, certification and regulatory matters reports to.

  • Thank you. Which kind of "compliance family" do you rather have in mind ? I can think of finance (e.g. ensure that the books are correct), quality (e.g. ensure that the product is aligned with expectations), security, privacy, regulatory (in the case of pharma for instance), ... Each of them tends to be with someone else.
    – WoJ
    Nov 29, 2016 at 16:38
  • 1
    In the case of PCI, it'd be the person who has responsibility for compliance with PCI. They want an officer to take responsibility for the statements in the SAQ and who can ensure that the company remains in compliance.
    – crovers
    Nov 29, 2016 at 16:49

All depends on merchant level. Level 1: QSA, Level 2: ISA/ QSA, Level 3 & 4: Security lead or IT manager. Note: sign off requirements are different for AOC.

  • Would you have any sources for this distribution?
    – WoJ
    Dec 8, 2016 at 12:04
  • Please ref to pci guide of cc brand of your region
    – user132760
    Dec 17, 2016 at 13:07
  • 1
    there is no such reference because PCI-DSS is one standard.
    – WoJ
    Dec 17, 2016 at 13:18

It's the person who is in charge of the PCI, in any company, who does this as well. In the ideal sense, it's the Merchant Executive Officer of a company who does this. In some companies, it would be the CFO (Chief Financial Officer) who has this additional responsibility as well. Sometimes it's the COO or CEO who handles this as an additional responsibility. Well, all this depends on the size of the company and also on how the hierarchy works in the organizational set-up.

Source: https://www.hackerguardian.com/pci-saq.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.