What changed in PCI DSS SAQ A in 2025?
On March 31, 2025, requirements 6.4.3, 11.6.1 and 12.3.1 were removed from SAQ A and replaced by an eligibility criterion: the merchant must confirm its site is not susceptible to script attacks, either through its own controls or a written confirmation from the provider supplying the iframe. ASV scans still apply.
In detail
On March 31, 2025, requirements 6.4.3, 11.6.1 and 12.3.1 were removed from SAQ A and replaced by an eligibility criterion: the merchant must confirm its site is not susceptible to script attacks, either through its own controls or a written confirmation from the provider supplying the iframe. ASV scans still apply.
What is a PCI DSS self-assessment questionnaire?
PCI DSS applies to every entity that stores, processes or transmits cardholder data. Large merchants and large service providers are assessed on site by a Qualified Security Assessor, who writes a Report on Compliance (ROC) and signs an Attestation of Compliance (AOC). Smaller entities validate themselves with an SAQ: a checklist of PCI DSS requirements, filtered down to the ones that apply to a given way of accepting cards, plus the same AOC. The SAQ types for v4.0.1 are A, A-EP, B, B-IP, C, C-VT, D for merchants, D for service providers, P2PE and SPoC, published in October 2024, with the v4.0 SAQs retired at the end of 2024.
SAQ A vs SAQ A-EP vs SAQ D: which one applies to which integration?
The gap between the three is large. After the 2025 update, SAQ A has 27 applicable requirements, against 151 for SAQ A-EP, and SAQ D runs to around 250.
More detail in our #PayDecoding episode on PCI DSS SAQ.