SAQ C, v3.1 - PCI Security Standards Council - pcissc 2025

See details

4.9 out of 5

36 votes

The document outlines the Payment Card Industry Data Security Standard (PCI DSS) Self-Assessment Questionnaire C and Attestation of Compliance for merchants with payment application systems connected to the internet, specifically those that do not store electronic cardholder data. It details compliance requirements, assessment steps, and guidelines for completing the self-assessment questionnaire. The document includes sections on maintaining secure networks, protecting cardholder data, managing vulnerabilities, implementing access controls, monitoring networks, and maintaining an information security policy. It also provides appendices for compensating controls and non-applicability explanations.

Here's how it works

01. Edit your pcissc online

Type text, add images, blackout confidential details, add comments, highlights and more.

02. Sign it in a few clicks

Draw your signature, type it, upload its image, or use your mobile device as a signature pad.

03. Share your form with others

Send saq form 50000 transactions via email, link, or fax. You can also download it, export it or print it out.

How to use or fill out SAQ C, v3.1 - PCI Security Standards Council - pcissc with our platform

Ease of Setup

DocHub User Ratings on G2

Ease of Use

DocHub User Ratings on G2

Click ‘Get Form’ to open the SAQ C, v3.1 document in the editor.
Begin with Section 1: Assessment Information. Fill in your company details, including name, contact information, and business address.
Proceed to Section 2: Self-Assessment Questionnaire C. Answer each question based on your compliance status by selecting 'Yes', 'No', or 'N/A'.
For each requirement, provide detailed responses as necessary. If using compensating controls, ensure to complete the Compensating Controls Worksheet in Appendix B.
Finally, review Section 3: Validation and Attestation Details. Confirm all information is accurate and submit the completed form to your acquirer.

Start using our platform today for free to streamline your SAQ C completion process!

be ready to get more

Complete this form in 5 minutes or less

Get form

Got questions?

We have answers to the most popular questions from our customers. If you can't find an answer to your question, please contact us.

What is PCI SAQ C?

SAQ C merchants process cardholder data via a point-of-sale (POS) system or other payment application systems connected to the Internet, do not store cardholder data on any computer system, and may be either brick-and-mortar (card-present) or mail/telephone-order (card-not-present) merchants.

What does SAQ C stand for?

The PCI Self-Assessment Questionnaire (SAQ) C is designed for merchants with internet-connected payment application systems. PCI SAQ C merchants process cardholder data with point of sale (POS) systems or other internet-connected payment application systems, and do not store cardholder data on any computer system.

What are the different types of SAQs?

PCI DSS SAQ C: Its for merchants with payment applications connected to the internet. It contains 160 questions aligned with 12 security requirements. Key Security Standards: Includes firewall protection, encryption of data over networks, and stringent access controls.

Can I do my own PCI compliance?

PCI compliance is voluntary and based on self-assessment, or a lightweight external assessment that takes less than a month.

What is SAQ type C?

SAQ C is specifically intended for merchants and service providers that have a more complex cardholder data environment than those eligible for SAQ A or SAQ A-EP but dont meet the criteria for SAQ B, which is designed for merchants using imprint machines with no electronic cardholder data storage.

Try more PDF tools