PCI self-assessment questionnaire: a step-by-step guide

What is the PCI self-assessment questionnaire?

PCI DSS, the Payment Card Industry Data Security Standard, is the security standard every business that takes card payments has to follow. The self-assessment questionnaire is how most small businesses show they do. It is a set of questions about how you take payments and protect card data, which you answer yourself and then sign to confirm. There is no outside audit for a typical small business.

For the bigger picture, including what PCI compliance covers and where fees come from, read our PCI compliance guide. This guide is the practical follow-up: how to actually complete the questionnaire.

Which SAQ does a small shop complete?

There are several versions of the SAQ, and the right one depends on how you take payments. You do not have to work this out on your own, because your provider will tell you which version applies. In general terms:

• Businesses using a standalone card machine, where the card is handled by the terminal and your till never sees card details, usually complete one of the shortest versions. Which one depends on how the terminal connects and how it protects card data.
• Businesses taking payments only through a fully outsourced online page, where the card details are entered on the payment provider's site, also complete a short version.
• Businesses that take card details over the phone, or whose till or website handles card data, face a longer questionnaire with more questions.

The more of the card journey that happens inside a secure terminal or a provider's own page, the fewer questions you answer. That is a good reason to let the terminal handle everything and never key card numbers into your own systems.

How to complete the SAQ, step by step

1. Find the request. Your provider will usually email you or point you to an online portal. Check your junk folder and make sure the provider has your current contact details.
2. Confirm which SAQ applies. Ask the provider in writing which version is right for how you take payments, and note it down.
3. Gather the basics. Know how many terminals you have, where they are kept, how they connect (Wi-Fi, Ethernet or 4G), who uses them and whether you ever take card details by phone.
4. Answer every question honestly. Each answer is yes, no or not applicable. If the answer is no, the questionnaire usually explains what to put right.
5. Fix any gaps. Typical examples are a default router password, an unlisted terminal or card numbers written on paper. Put these right and then answer again.
6. Sign the declaration. A named person at the business confirms the answers are true. Do not sign something you have not checked.
7. Submit it and keep proof. Save the confirmation and ask your provider to confirm in writing that your questionnaire is complete.
8. Put the next date in your diary. It normally comes round every year.

Deadlines: what to expect in general terms

The card schemes expect compliance to be validated regularly, and providers normally ask for the questionnaire once a year. The exact dates and reminder process are set by your provider, not by us, so check your agreement and any reminders you have received. Two practical points apply to nearly everyone:

• Reminders often go to an old email address or a former employee, so confirm who receives them.
• If a deadline passes, some providers add a non-compliance charge until the questionnaire is done. Completing it usually stops the charge going forward, and it is worth asking whether earlier charges can be reviewed.

Practical habits that make the SAQ easy

• Use only the terminal you were supplied and let customers enter their own PIN.
• Never store card details on paper, in a notebook, a spreadsheet, a photo, an email or a message.
• Keep a simple terminal list with serial numbers and where each one is kept, and check for signs of tampering.
• Secure your network. Change default passwords and keep customer Wi-Fi separate from the network your till or terminal uses.
• Brief your staff on what to do if a terminal goes missing or behaves oddly.
• Install updates when your provider asks.

The fees side of PCI

The questionnaire itself is free to complete. The cost people notice is the provider's own PCI charge, which varies. Some charge nothing, some charge a monthly or annual fee, and some add a higher non-compliance fee. Check your statements for lines such as PCI, compliance or non-compliance, and ask your provider in writing for every monthly and annual fee. Our card machine fees guide shows how to add everything up.

PCI questionnaire: common questions

Related

• What is PCI compliance in the UK?
• Card machine fees explained
• How to switch card machine provider
• PayZu pricing