If we have a SAQ A compliant website for online signups, can we also use SAQ C-VT for phone orders? I'm thinking yes since they're separate payment channels but this aspect is new to me.

  • Interesting question. I suspect the answer is "submit them both to your processor, and see if they accept them or not." – gowenfawr Mar 14 '19 at 20:37
  • My understanding is that each system needs a SAQ. So if card data goes from wherever to the processor and never touches the other system, then they are unrelated and need separate SAQs. If your phone order system involved your operators manually placing orders on your website on behalf of the customers, that'd be a different story. But I'm not a QSA, so I may be way off base. – Bobson Mar 15 '19 at 1:14

There is a relevant FAQ from the PCI SSC that addresses this questions. The gist of it is that you if the environment meets the criteria for the SAQ then you can use that SAQ as a reference for the requirements you need to meet for that environment.

In practice you would complete SAQ D and evaluate your responses based on how they pertain to the two environments. Each legal entity should only complete one SAQ or ROC for the entire company. To complete multiple SAQs would be misleading, as you can't answer truthfully to all criteria needed to complete either the SAQ A or C-VT, as the requirements for doing so apply to the company as a whole, and all SAQs besides D have stipulations that there are no other cardholder data flows.

When conducting your review, if neither SAQ A or SAQ C-VT contain a particular requirement, meaning the PCI SSC has deemed it not applicable for a particular type of environment, you can mark it as N/A in the SAQ D you are completing. If either one of them contain the requirement then you should evaluate how you are meeting that requirement for the related environment and document it accordingly.

The key to this method, as it states in the FAQ, is clearly documenting and explaining the approach you are taking in the Executive Summary of the SAQ. You need to clearly document and explain how the two environments are separate and individually qualify for a given SAQ, and the approach for evaluating each requirement for compliance.

| improve this answer | |
  • When I read the Executive Summary, it asks which payment channels does your burins serve and then also asks which payment channels are covered by this SAQ. That sure makes it sound like you could use multiple SAQs as long as you cover all your payment channels. – William Jens Mar 15 '19 at 21:03
  • No - you can use an SAQ for each channel. It would be best to agree this with your acquirer first. the SSC FAQ referenced above applied to using the limited requirements from an SAQ as the basis for a RoC. – withoutfire Mar 15 '19 at 22:34
  • 1
    @WilliamJens I see how that can be confusing in the Executive Summary. The PCI SSC tries to make their docs as universal as possible to fit a variety of use cases. The basis of my answer is on the very clear cut statements required to qualify of each SAQ. they all require you to confirm that you don't process cards in any other way except what is allowed by that SAQ, except for SAQ D. I don't see how you can truthfully complete the attestation when completing multiple SAQs. This is the reason for the approach outlined in the FAQ. The same approach outlined for a ROC can be applied to SAQ D. – Timee Mar 19 '19 at 2:45

Yes - it is fine to use two SAQs, one for each acceptance channel iff there is no connectivity between the two channels - ie there is nothing that is 'connected to' both channels. It is wise to let your processor/acquirer know that this is your approach and to document this in the SAQ.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.