Low down: This client does zero with credit card data (no processing, no passing of it, nothing), but they do have a device often placed on the same network segment of a POS (Point of sale) system.

The key is their clients are expecting them to follow PCI security requirements and to produce an attestation. Given this, which PCI SAQ is appropriate to use?

PCI document library: https://www.pcisecuritystandards.org/security_standards/documents.php

2 Answers 2


SAQ A is the most applicable, which is defined as " Card-not-present Merchants, All Cardholder Data Functions Outsource".

In all honesty, they can sign their name to any of the SAQs because without storing, processing, or transmitting cardholder data, they are meeting every point on the DSS. If I were them I would sign an SAQ D (which is the full DSS) because it looks better.

A better approach for them would be to show how the device that they place in the Cardholder Data Environment (CDE) is compliant with the PCI DSS.


I'm a bit puzzled - if they are not dealing with CC data in any way, then there is no PCI requirement for them. The initial response should be to ask what attestation their client wants and then work to that.

In fact, in going through the details of the PCI docs (which I havden't done in a few months, but was bored this evening) there is nothing I can hang on to point them at. Seriously, the key response to the clients should be:

PCI DSS has nothing for us, but what standards do you want us to meet?

  • actually this happens more than you think. customers under PCI regulation frequently want their business partners to be PCI compliant regardless of the requirement for them to be so or not. my client, in particular, is not allowed to respond to valuable RFPs without providing an attestation; also existing clients are more receptive to their products being deployed into their PCI compliant environments if they continue to show PCI compliance via attestation. short answer: provide PCI attestation or no sale. Jan 21, 2011 at 4:42
  • @Tate, there is no such thing as "PCI attestation". Either you have a QSA certify you as compliant, or not. You can fill out a SAQ if you want, but so what? That said, if they want to claim "compliance", they'd be better off looking at PA-DSS than the standard PCI. Of course, the problem will eventually come back to the fact that the client doesnt want them to break the client's PCI compliance...
    – AviD
    Jan 23, 2011 at 7:17
  • @Avid what? "Attest is a legal term that refers to the act of a person swearing to or affirming the truth of something". My client currently has an attestation of PCI compliance. It’s about to expire; hence this question. Jan 23, 2011 at 18:58
  • @Tate and @AviD - think you both mean the same thing but wording may be different in different countries. The QSA confirming your PCI compliance is often called an attestation.
    – Rory Alsop
    Jan 23, 2011 at 19:00
  • @Rory - thanks, yeah I guess its a wording issue. Never heard that called an attestation (even though I've done some work in the UK around PCI... :$). Sorry @Tate... But again, why would a QSA certify/attest on a product that doesnt use CHD?
    – AviD
    Jan 23, 2011 at 19:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .