Compliance Assessment ToolSAQ C: who needs it?
SAQ C is for a single-location business whose point-of-sale system or payment software runs on a device connected to the internet — kept separate from everything else.
This is probably you if…
- You run a payment application or POS system on a computer or device that is connected to the internet.
- It is one location, and the payment system is isolated from your other computers.
- You never store card numbers electronically.
Typical setups
- A restaurant or shop POS system where the card reader feeds into the register software.
- A computer running payment software with an attached card reader, on its own network.
It's probably not SAQ C if…
- Your terminal works on its own and only talks to the processor — that is usually SAQ B-IP.
- Your POS uses a validated P2PE solution — SAQ P2PE is usually far shorter.
- You have several locations on one shared network, or you store card numbers — that is usually SAQ D.
Not sure it's SAQ C?
Describe how you take payments in your own words and we'll check it against every SAQ's conditions — free. If it is SAQ C, we walk you through it in plain English and produce your signed SAQ and Attestation of Compliance.
Check my SAQ — free →The official eligibility criteria
To use SAQ C, the PCI Security Standards Council requires all of the following:
- The merchant has a payment application system and an Internet connection on the same device and/or same local area network (LAN);
- The payment application system is not connected to any other systems within the merchant environment (this can be achieved via network segmentation to isolate payment application system/Internet device from all other systems);
- The physical location of the POS environment is not connected to other premises or locations, and any LAN is for a single store only;
- The merchant does not store account data in electronic format, and
- Any account data the merchant might retain is on paper (for example, printed reports or receipts), and these documents are not received electronically.
Questions people ask
Is there a way to make my SAQ shorter?
Often. If your processor offers a validated P2PE terminal solution, moving to it can qualify you for SAQ P2PE, which is much shorter. Ask your provider whether your setup is a PCI-listed P2PE solution.
Other SAQ types
SAQ A · SAQ A-EP · SAQ B · SAQ B-IP · SAQ C-VT · SAQ P2PE · SAQ SPoC · SAQ D
This guide helps you identify the right self-assessment questionnaire. Your acquiring bank or payment processor decides which SAQ you must submit — confirm with them if you are unsure. Compliance Assessment Tool helps you complete a PCI DSS self-assessment; we are not a Qualified Security Assessor (QSA) and do not certify compliance. Eligibility criteria quoted from PCI DSS v4.0.1 SAQ C documentation published by the PCI Security Standards Council.