Home
Forms Library
Self assessment questionnaire

Self-Assessment Questionnaire A-EP 2025

self assessment questionnaire Preview on Page 1

Show details

4.9 out of 5

30 votes

The document outlines the Payment Card Industry Data Security Standard (PCI DSS) Self-Assessment Questionnaire A-EP, specifically designed for partially outsourced e-commerce merchants that utilize third-party payment processors. It provides guidelines for compliance with PCI DSS version 3.2, detailing requirements for securing cardholder data, maintaining secure networks, and implementing strong access controls. The document includes sections on assessment information, a self-assessment questionnaire, validation details, and appendices addressing additional requirements and compensating controls. It emphasizes the importance of ensuring that all third-party service providers are PCI DSS compliant and outlines steps for completing the self-assessment process.

Here's how it works

01. Edit your self assessment questionnaire online

Type text, add images, blackout confidential details, add comments, highlights and more.

02. Sign it in a few clicks

Draw your signature, type it, upload its image, or use your mobile device as a signature pad.

03. Share your form with others

Send it via email, link, or fax. You can also download it, export it or print it out.

The easiest way to modify Self-Assessment Questionnaire A-EP in PDF format online

Ease of Setup

DocHub User Ratings on G2

Ease of Use

DocHub User Ratings on G2

Adjusting documents with our comprehensive and user-friendly PDF editor is straightforward. Follow the instructions below to complete Self-Assessment Questionnaire A-EP online quickly and easily:

Log in to your account. Log in with your email and password or create a free account to test the product prior to upgrading the subscription.
Upload a document. Drag and drop the file from your device or import it from other services, like Google Drive, OneDrive, Dropbox, or an external link.
Edit Self-Assessment Questionnaire A-EP. Easily add and underline text, insert images, checkmarks, and icons, drop new fillable areas, and rearrange or delete pages from your document.
Get the Self-Assessment Questionnaire A-EP accomplished. Download your modified document, export it to the cloud, print it from the editor, or share it with others via a Shareable link or as an email attachment.

Take advantage of DocHub, one of the most easy-to-use editors to rapidly manage your documentation online!

be ready to get more

Complete this form in 5 minutes or less

Get form

Got questions?

We have answers to the most popular questions from our customers. If you can't find an answer to your question, please contact us.

What is requirement 11 for SAQ A?

Note: For SAQ A, Requirement 11 applies to merchant web servers that host the page(s) that either 1) redirects customers from the merchant website to a TPSP/payment processor for payment processing (for example, with a URL redirect) or 2) includes a TPSPs/payment processors embedded payment page/form (for example,

How many questions are there in SAQ A-EP?

Unlike PCI SAQ A, which has 22 questions in total, A-EP has 191 questions. Some questions you have to answer for SAQ A-EP are: Do you have a formal process to validate and test all network connections and firewall and router configuration changes?

What is requirement 11 in PCI DSS?

Regular in the context of PCI DSS implies a scheduled and systematic approach to security testing. Specifically, Requirement 11 mandates that you conduct quarterly external and internal vulnerability scans, and annual testing.

What is self-assessment questionnaire SAQ A?

SAQ A has been developed to address requirements applicable to merchants whose cardholder data functions are completely outsourced to validated third parties, where the merchant retains only paper reports or receipts with cardholder data.

What is the difference between SAQ A and SAQ A EP?

Unlike the SAQ A, with the SAQ A-EP organizations play some role in directing the customers payment information to the service provider. This might look like a merchant-controlled checkout that collects payment information online and uses an API to post cardholder data directly to its service providers system.

What is the difference between SAQ A and a-EP?

The biggest difference between the two is SAQ A involves merchants that outsource all responsibility of their card data to third party, while SAQ A-EP involves merchants that dont receive cardholder data, but control how cardholder data is redirected to a PCI DSS validated third-party payment processor.

What is requirement 11.6 1 PCI?

Essentially, PCI 11.6. 1 emphasises the importance of implementing change- and tamper-detection systems on payment pages. These systems serve to notify authorised personnel about any unauthorised modifications. Additionally, the received HTTP header on the payment page must be evaluated.

What is the PCI requirement 1.1 1?

PCI Requirement 1.1. 1 requires, a formal process for approving and testing all network connections and changes to the firewall and router configurations. The PCI DSS v3. 2.1 states that PCI Requirement 1.1.

Self-Assessment Questionnaire A-EP 2025

Here's how it works