Do SAQ A merchants still have security requirements?

Yes. SAQ A is the lightest questionnaire, but it still includes requirements on passwords, patches, vendor management and incident response. Since January 2025, merchants also have to confirm their site is not susceptible to attacks from scripts that could affect their e-commerce systems. A lighter scope is not the same as no scope.

Lightest, not empty

SAQ A is the shortest questionnaire, for merchants that outsource card handling entirely. It still contains requirements: strong passwords and multi-factor authentication for accounts with access to the e-commerce environment, patches applied to systems in scope, management of service providers and their compliance status, and an incident response plan.

What changed in 2025

• Since January 2025, SAQ A merchants must confirm that their e-commerce site is not susceptible to attacks from scripts that could affect their payment systems.
• This reflects the risk of skimming scripts injected on merchant pages, which can redirect customers or capture data even when the payment form is hosted elsewhere.
• Merchants meet it through script management, content security policies or confirmation from their provider.

For operators

A merchant that believes SAQ A means "nothing to do" is a risk to its acquirer and to the operator. The operator's onboarding and annual review should list the SAQ A requirements in plain terms and collect the merchant's attestation. Providing a hosted page that handles script integrity on the provider's side reduces what the merchant has to attest, but it does not remove the questionnaire.