PCI DSS SAQ Assistance

Understanding PCI DSS SAQ

The PCI DSS Self-Assessment Questionnaires (SAQs) are validation tools intended to assist merchants and service providers in self-evaluating their compliance with the PCI DSS. Ideal for small merchants and service providers that are not required to submit a report on compliance, a Self-Assessment Questionnaire (SAQ) is designed as a self-validation tool to assess security for cardholder data.

One of the simplest types of PCI DSS validation, the SAQ, can still be daunting. It can be hard to know where to start, which SAQ is correct for you or how the process works. Our PCI SAQ Assistance services was created with the objective to complete the SAQ on your behalf while you can continue to focus on your business.

SAQ or a full RoC?

A PCI DSS assessment is performed by an external Qualified Security Assessor. At the end of the assessment, a Report on Compliance (RoC) is delivered. A self-Assessment on the other hand, can be completed by the organizations themselves. Weather you need a SAQ or full RoC would be decided by your Acquirer and is dependent on you level categorization. Your level is dependent on the number of card transactions conducted by your business.

Which SAQ?

There are multiple versions of the PCI DSS SAQs to meet various business types and processes. How you process credit cards and handle cardholder data determines which SAQ your business needs to fill out. GRC Assist can work with you to determine the right SAQ your business needs to complete.

How can GRC Assist Help?

While SAQs are self-assessments, it requires a through examination of relevant applicable controls and decide if the controls are compliant with the PCI DSS requirements. Out consultants will work with you to determine if the SAQ type selected is correct for your organization. We will then work with your stakeholders to review the controls in place at your organization and complete the SAQ on your behalf.

Our Methodology

• Phase 1 – Understanding Business and Process and Determine the correct SAQ
• Phase 2 – Review controls in accordance with the SAQ requirements
• Phase 3 – Analysis and Document SAQ
• Phase 4 – SAQ Delivery and post-delivery questions