The system will use PayPal Express Checkout. This means that it should
be eligible for SAQ A
I don't believe* PayPal Express Checkout is an iframe implementation, so it would not be eligible for SAQ A, but rather SAQ A-EP, which has a more significant number of questions.
*I'm open to be corrected on this point. But the merchant is the one who needs to be crystal clear on it as per DSS §12.8.5, which is part of SAQ A.
It's a self-assessment questionnaire so I can fill it out myself, right?
Does this mean I complete the document and store it away until it's needed again?
You will need to update it and re-attest it annually, so you have - and may need to submit to your processor - a new document every year. And the signature on it comes from "Merchant Executive Officer," so unless you're the Big Boss, you're filling out something the Big Boss has to put their name to.
Granted that most of the answers are likely to stay the same, you are still expected to research them. Some of them deal with annual practices you're expected to do, such as monitoring your service providers' PCI DSS compliance. You should expect to review the document each year and verify it is still true, rather than simply dusting it off and altering the dates.
I can't see where any cost of incurred. Am I being naive - can anyone
shed any light, please?
- The work involved to do it right is more extensive then the tone of
your question suggests you appreciate**.
- The crux of the SAQ is responsibility; the signer is responsible for representing the truth of the questionnaire, and in the event of a breach the penalties are likely to be worse if the SAQ is found to be slipshod or misleading.
**tone is difficult (reading and writing) in text, and no slight is intended.