I am confused because it says SAQ-A is valid when "All processing of
cardholder data is entirely outsourced to PCI DSS validated
third-party service providers", yet SAQ C-VT is needed when a virtual
terminal (hosted by a validated third-party) is used to take payments.
What differs is who takes the call.
For SAQ C-VT, the Merchant has employees who sit at a Virtual Terminal hosted by a validated Third-Party Service Provider. Customers call the Merchant, the Merchant's employee types their card numbers into the VT, the purchase proceeds.
When SAQ A says (emphasis mine):
SAQ A merchants confirm that, for this payment channel:
- Your company accepts only card-not-present (e-commerce or mail/telephone-order) transactions;
- All processing of cardholder data is entirely outsourced to PCI DSS validated third-party service providers;
They are describing a setup where the Merchant outsources the entire telephone-order process to a validated Third-Party Service Provider. The Customer calls the number provided by the Merchant, but it rings at the Third-Party call center, and a Third-Party employee takes the details, enters them into the terminal, and proceeds with the purchase.
(In both cases, of course, the Third-Party is subject to much more extensive compliance requirements than either SAQ A or SAQ C-VT. The limited scope of those two SAQs rely upon the offloading of scope to the Third-Party Service Provider).
So how could telephone orders be taken and the merchant remain under SAQ-A?
If the phone calls go directly to the Third-Party Service Provider, and not to the Merchant, the Merchant may remain SAQ A.