I did not find any mention of the need to renew a self-assesment (PCI DSS SAQ-A or SAQ-A-EP) in the PCI DSS documentation.

There are mentions of renewal for assessors (to maintain their accreditation) and a search over Internet points to random sites with exactly this question (should the certification be renewed) - and the response is "yes, yearly" without any sources.

Is there a primary source for the need to renew a SAQ-A/A-EP questionnaire?


From the intro section 'Scope of PCI DSS Requirement' in v3.2:

The first step of a PCI DSS assessment is to accurately determine the scope of the review. At least annually and prior to the annual assessment, the assessed entity...

A SAQ is completed in lieu of an assessment and given that the assessment requirement is annual, by implication that SAQ requirement is annual as well.

  • Thank you - I somehow missed this word when scanning the docs, including the work "annual" – WoJ Sep 28 '17 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.