Contents
How is PCI compliance level calculated?
In fact, there are four PCI compliance levels, which are determined by the number of transactions the organisation handles each year.
- Level 1: Merchants that process over 6 million card transactions annually.
- Level 2: Merchants that process 1 to 6 million transactions annually.
What is Saq in PCI?
Ideal for small merchants and service providers that are not required to submit a report on compliance, a Self-Assessment Questionnaire (SAQ) is designed as a self-validation tool to assess security for cardholder data. There are different questionnaires available to meet different merchant environments.
What are the compliance levels for PCI DSS?
Level 3 and Level 4 merchants may alternatively, at their own discretion, engage a PCI SSC-approved QSA to complete a ROC instead of performing an SAQ. Level 4 merchants are required to comply with the PCI DSS.
How are SAQs used to validate PCI compliance?
To assist merchants and service providers in validating compliance with the PCI DSS, a number of Self-Assessment Questionnaires (SAQs) are available – each applicable to a specific payment scenario. Depending on the volumes of card data transacted, validation can be by self-assessment and the relevant SAQ documentation, rather than formal audit.
How often does a PCI Level 2 merchant need a SAQ?
PCI Level 2 Merchants PCI Level 2 is valid for merchants that process between one and six million credit or debit card transactions annually across all channels (card present, card not available, e-commerce). They must conduct an assessment once a year using a self-assessment questionnaire (SAQ). Also, they may need a quarterly PCI ASV scan.
Which is the default catch-all SAQ for PCI?
Because SAQ D is the default catch-all SAQ, there may still be parts of it that aren’t applicable to your environment. One example is the requirement that track data from the magnetic stripe isn’t stored – this isn’t relevant for card-not-present transactions.