0

I'm having a hard time figuring out / finding answers to determining the cost of becoming PCI DSS compliant for SAQ A.

The system will use PayPal Express Checkout. This means that it should be eligible for SAQ A (i.e., cardholder data and transaction processing happens on PayPal server).

Completing SAQ A is mostly a paper exercise and no vulnerability assessment is required from an ASV.

It's a self-assessment questionnaire so I can fill it out myself, right? Additionally, for SAQ A our payment brands and payment acquirers do require us to submit the completed SAQ as proof of PCI DSS validation.

Does this mean I complete the document and store it away until it's needed again?

I can't see where any cost of incurred. Am I being naive - can anyone shed any light, please?

  • 2
    Self-assessments cost nothing. Failure to pass an audit can cost big in terms of fines. Kinda like doing your own taxes. You can get the forms for free and fill them out yourself, or pay someone to do it for you. – schroeder Jan 18 '17 at 12:03
3

The system will use PayPal Express Checkout. This means that it should be eligible for SAQ A

I don't believe* PayPal Express Checkout is an iframe implementation, so it would not be eligible for SAQ A, but rather SAQ A-EP, which has a more significant number of questions.

*I'm open to be corrected on this point. But the merchant is the one who needs to be crystal clear on it as per DSS §12.8.5, which is part of SAQ A.

It's a self-assessment questionnaire so I can fill it out myself, right?

Correct.

Does this mean I complete the document and store it away until it's needed again?

You will need to update it and re-attest it annually, so you have - and may need to submit to your processor - a new document every year. And the signature on it comes from "Merchant Executive Officer," so unless you're the Big Boss, you're filling out something the Big Boss has to put their name to.

Granted that most of the answers are likely to stay the same, you are still expected to research them. Some of them deal with annual practices you're expected to do, such as monitoring your service providers' PCI DSS compliance. You should expect to review the document each year and verify it is still true, rather than simply dusting it off and altering the dates.

I can't see where any cost of incurred. Am I being naive - can anyone shed any light, please?

  • The work involved to do it right is more extensive then the tone of your question suggests you appreciate**.
  • The crux of the SAQ is responsibility; the signer is responsible for representing the truth of the questionnaire, and in the event of a breach the penalties are likely to be worse if the SAQ is found to be slipshod or misleading.

**tone is difficult (reading and writing) in text, and no slight is intended.

  • Thanks for answering, gowenfawr! Apologies if my question appeared a little nonchalant... I certainly don't consider compliance as "just another hoop to jump through" and am trying to get to grips with what's required to have a good stab at doing it properly. I really appreciate the clarification you've provided, it's going to help out a lot. – EasyR Jan 19 '17 at 13:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.