I have received some interesting questions of late regarding various scenarios and how to fill out specific self-assessment questionnaires or SAQs. The troubling part to these questions is that they are totally misinterpreting how to apply the SAQs to particular businesses. As a result, I thought it was a good time to discuss the various incarnations of SAQs and how they apply to various businesses.
For those of you unfamiliar with the PCI SAQs, there are five; A, B, C, C-VT and D. The first four are designed for very specific business scenarios and D is the catch all when none of the previous four seem to fit. In the QSA trade, SAQ D is referred to as Report On Compliance (ROC) ‘Light’ because any organization that has to fill out SAQ D is essentially going through all 12 PCI DSS requirements, albeit on a reduced scale. If your business does not fit the criteria for the other four SAQs, then you are expected to use SAQ D.
The first important fact about the SAQs is that they can only be used by merchants classified as Level 2 through 4 or Level 2 service providers. And the most important fact, while anyone can give you an opinion regarding which SAQ your organization should use, only your acquiring bank can officially determine which SAQ your organization should use. That said, in the front of every SAQ under a section entitled ‘Completing the Self-Assessment Questionnaire’, the SAQ documents the criteria for using the particular SAQ. If your organization does not meet all of the criteria, then you cannot use the SAQ.
SAQ A is designed for merchants that have no brick and mortar stores such as those similar to Amazon.com. In addition, the merchant must be totally outsourcing its processing, storing and transmission of cardholder data to a third party such as Level 3 or IBM and those providers must be PCI compliant. Finally, the organization cannot be storing cardholder data electronically. However, the organization can have paper reports and receipts that contain cardholder data, but those documents cannot be received electronically.
For SAQ B, your company needs to go back to the “stone age” of credit card processing. The organization must be using stand-alone card terminals or manual embossers also known as a “knuckle buster.” In the case of a stand-alone terminal, the terminal cannot be connected to a network or the Internet. No cardholder data can be stored electronically. The organization can have paper reports and receipts that contain cardholder data, but those documents cannot be received electronically.
In SAQ C, we get to versions; the standard SAQ C and SAQ C-VT. The original SAQ C is for organizations that run integrated point of sale (POS) systems on a network that only connects to the Internet for authorization and does not store cardholder data. To qualify to use SAQ C, the organization must meet the following criteria.• The payment application system and the Internet connection are on the same device and/or same local area network (LAN);
- The payment application/Internet device is not connected to any other systems within the organization’s environment (this can be achieved via network segmentation to isolate payment application system/Internet device from all other systems);
- The organization’s retail facility is not connected to other retail locations, and any LAN is for a single retail location only;
- The organization retains only paper reports or paper copies of receipts;
- The organization does not store cardholder data in electronic format; and
- The organization’s payment application vendor uses secure techniques to provide remote support to your payment system.
Where most organizations go wrong with the original SAQ C is when they have an integrated POS that connects back to a corporate network. Remote management is allowed in this environment, but the entity that remotely connects must not have unlimited or uncontrolled access to the POS environment. We have run into a number of instances, particularly in the fast food and hospitality/hotel industry, where the franchisee’s POS solution fits the SAQ C criteria. However, upon further investigation, we find that SAQ C cannot be used because the POS environment is connected managed from the franchisee’s corporate office or it is managed or connected to the franchiser’s corporate office.
New for version 2.0 of the PCI DSS is SAQ C-VT. This was developed to handle virtualized environments. Virtual can be either full on thin clients such as a Wyse terminal or a PC where only a browser is used to process cardholder data. However, the same connectivity requirement remains in that the thin client or PC must only connect to an acquirer, processor or third party. Finally, and the most important aspect for this SAQ, cardholder data can only be entered manually.
So those are the rules surrounding using SAQs. Hopefully all of you small merchants can now figure out which SAQ to use. However, remember, please consult with your acquiring bank on which SAQ to use before you pick one. If your acquiring bank gives you no idea, then use this posting to make your choice.
