pci-dss-v4

SAQ selection depends on how you accept card payments. SAQ-A applies when all cardholder data functions are fully outsourced via redirect or iframe, SAQ-A-EP applies when your e-commerce page hosts scripts touching payment data, and SAQ-B-IP applies to standalone IP-connected terminals.

SAQ-A covers merchants whose payment page is entirely hosted by a compliant third party, with about 22 requirements. SAQ-A-EP applies when the merchant controls the page or scripts capturing payment data, requiring roughly 191 requirements including WAF, ASV scans, and penetration testing.

Key changes include mandatory payment page script integrity (6.4.3) and tamper detection (11.6.1) from April 2025, MFA for all CDE access, 12-character minimum passwords, targeted risk analyses, and a new customized approach option. All v3.2.1 assessments retired December 31, 2024.

Scope reduction uses tokenization, which replaces PANs with valueless tokens so downstream systems fall out of scope, or PCI-validated point-to-point encryption (P2PE) for card-present environments. Network segmentation validated by penetration testing also isolates out-of-scope systems.

A QSA-produced Report on Compliance is required for Level 1 merchants (over 6 million transactions annually) and Level 1 service providers. Level 2-4 merchants typically self-assess via SAQ, and the v4.0 customized approach always requires QSA validation.