To fill out the SAQ-D, download the current PCI DSS v4.0.1 version of the questionnaire from the PCI Security Standards Council’s document library, gather the network diagrams, scan results, test reports, and policies you’ll cite as evidence, work through the identification sections and every applicable question across the twelve PCI DSS requirements, complete a Compensating Controls Worksheet for any control you’re substituting, and submit the finished form with a signed Attestation of Compliance to your acquiring bank (merchants) or the requesting card brand or client (service providers). The merchant version runs about 250 questions; the service provider version, about 270.
Confirm SAQ-D Is the Right Form for You
SAQ-D is the catch-all. If you handle payment card data and don’t qualify for a shorter, more narrowly scoped SAQ, this is the one you file. The PCI SSC publishes two separate PDFs, and you need the one that matches your role.
SAQ-D for Merchants applies to any SAQ-eligible merchant that doesn’t meet the criteria for a narrower questionnaire, such as e-commerce merchants that accept cardholder data directly on their site, merchants that store cardholder data electronically, or any merchant whose processing environment doesn’t fit forms like SAQ A (fully outsourced e-commerce) or SAQ C-VT (virtual terminal only).1PCI Security Standards Council. PCI DSS v4.0 SAQ D for Merchants and Attestation of Compliance If your payment systems sit on the same network as your general corporate systems, you’ll almost certainly land here.
SAQ-D for Service Providers covers payment gateways, hosted payment page providers, managed security services, and any organization that processes, stores, or transmits cardholder data on behalf of another entity. Service providers can’t file a shorter SAQ. Their version also carries obligations merchants don’t face, including maintaining a documented cryptographic architecture (Requirement 3.6.1.1), providing password guidance to customer users (Requirement 8.3.10), and testing network segmentation controls every six months instead of annually.2PCI Security Standards Council. PCI DSS v4.0 SAQ D for Service Providers and Attestation of Compliance
Not every organization can self-assess at all. Visa Level 1 merchants (more than six million Visa transactions per year across all channels) must complete a full Report on Compliance conducted on-site by a Qualified Security Assessor, and other card brands set their own thresholds, so confirm your validation method with your acquirer.3Visa. Validation of Compliance Following a data breach, your acquirer or the card brands may also require a full ROC regardless of transaction volume.
Download the Current Version and Gather Your Evidence
Download SAQ-D from the PCI SSC’s document library at pcisecuritystandards.org. The Council has published SAQs aligned with PCI DSS v4.0.1, so verify you’re working from that version rather than an older v4.0 or v3.2.1 file.4PCI Security Standards Council. SAQs for PCI DSS v4.0.1 Now Available
Before you start marking answers, pull together the documentation you’ll reference throughout the assessment:
- Current network diagrams showing every connection into and out of your cardholder data environment (CDE), including connections to third-party networks and the internet.
- A verified asset inventory of all hardware, software, and system components that store, process, or transmit cardholder data.
- Passing external scan reports from an Approved Scanning Vendor (ASV), performed at least once every three months, plus internal vulnerability scan results on the same quarterly cadence.5PCI Security Standards Council. Resource Guide: Vulnerability Scans and Approved Scanning Vendors
- Results from internal and external penetration tests conducted within the last twelve months using an industry-accepted methodology. Findings rated as exploitable must be remediated and retested before you can mark related items “In Place.”
- A list of every service provider that has access to your CDE or could affect its security, with written agreements defining their PCI DSS responsibilities.
- Your information security policy, incident response plan, and data retention and disposal policy.
Scope the Assessment Before You Answer
Scoping is where most SAQ-D assessments go wrong. Every system that stores, processes, or transmits cardholder data is in scope, along with any system that could affect the security of those components. If your payment systems share a flat network with office workstations and email servers, all of that equipment falls inside the assessment boundary, and every one of those systems has to answer to the SAQ-D questions.
Network segmentation can shrink the scope substantially. Isolating your CDE on its own segment, protected by firewalls or other access controls that restrict traffic in and out, lets you exclude systems that never touch cardholder data.6PCI Security Standards Council. Guidance for PCI DSS Scoping and Network Segmentation Validate the isolation through penetration testing of the segmentation controls at least annually, or every six months for service providers.
PCI DSS v4.0.1 Requirement 12.5.2 also requires an annual scope confirmation, where you formally document and validate the accuracy of your CDE scope.7PCI Security Standards Council. Now is the Time for Organizations to Adopt the Future-Dated Requirements of PCI DSS v4.x Get this right before you touch the questionnaire.
Work Through the Questionnaire
Part 1: Organization Information
The first section asks for your company name, DBA, primary business address, the contact person responsible for the assessment, the URLs of any payment-facing websites, and your merchant or service provider status. Straightforward, but your acquirer uses these details to match the SAQ to your merchant account, so accuracy matters.
Part 2: Executive Summary
The executive summary asks you to describe your payment channels (e-commerce, mail/telephone order, card-present), the technologies used to process transactions, and every third-party service provider that accesses or could affect your CDE. This section defines the scope for whoever reviews the form. Omit a payment channel or a service provider, and the entire assessment can be questioned during a later audit. Slow down here.
Part 3: The Twelve Requirements
The bulk of SAQ-D walks through every PCI DSS requirement, organized under six goals covering network security and secure configuration, protection of stored and transmitted account data, vulnerability management, access control, monitoring and testing, and information security policy.8PCI Security Standards Council. PCI DSS Quick Reference Guide Under v4.0.1, multi-factor authentication is required for all access into the CDE, not just remote access.
Response Options
For each question, choose one of five responses:
- In Place: the requirement is fully met and you have evidence to prove it.
- In Place with CCW: met through a compensating control. Complete a Compensating Controls Worksheet in the SAQ appendix for every question marked this way.
- In Place with Remediation: the requirement wasn’t met when first tested, but you fixed the gap and put processes in place to prevent recurrence before completing the SAQ. Explain in the appendix.
- Not Applicable: the requirement doesn’t apply to your environment. A written explanation is required in the appendix.
- Not in Place: the requirement isn’t met. This flags a gap that must be remediated before the assessment can be considered complete.
SAQ-D has no “Not Tested” option. Every requirement has to be evaluated. The customized approach, where you design your own controls to meet a requirement’s objective rather than its literal text, is also unavailable in any SAQ; that validation path requires a full ROC.1PCI Security Standards Council. PCI DSS v4.0 SAQ D for Merchants and Attestation of Compliance
Handling Compensating Controls
When a legitimate technical or business constraint prevents you from meeting a requirement exactly as written, you can implement an alternative measure that addresses the same risk. A common scenario involves legacy systems that can’t support current encryption standards, where layered monitoring and access restrictions serve as the compensating measure.9PCI Security Standards Council. PCI DSS v4.0: Compensating Controls vs Customized Approach
For every item you mark “In Place with CCW,” complete a Compensating Controls Worksheet in the SAQ appendix. The worksheet requires you to explain the constraint preventing compliance with the original requirement, describe the compensating control in detail, explain how it meets the intent of the requirement, and document any additional risk the alternative introduces. Vague descriptions get pushback from acquirers, so be specific about what the control does and how you validate it.
Sign the AOC and Submit
The final section is the Attestation of Compliance, a formal declaration that your organization has completed the assessment and disclosed its compliance status. A senior officer, typically a CISO, CFO, or CEO, must sign the AOC, certifying accuracy and accepting responsibility for the organization’s security posture. Misrepresenting your compliance status can lead to contractual penalties and liability exposure if a breach occurs.
Where you send the completed SAQ and AOC depends on your role:
- Merchants submit to their acquiring bank, which validates compliance on behalf of the card brands and maintains the documentation.10Visa. Account Information Security Program and PCI
- Service providers typically submit directly to individual card brands or to business clients that need proof of the provider’s compliance for their own assessments.
Ask your acquirer or the requesting party whether they take the SAQ electronically (most do) or want physical copies. Some acquirers run compliance portals where you upload the documents directly.
After Submission: Records, Renewal, and Penalties
Keep the completed SAQ, signed AOC, and all supporting evidence (scan reports, penetration test results, policy documents, compensating control worksheets) organized and accessible. Your acquirer or a card brand may request these records during an investigation or after a breach. PCI DSS specifies retention periods for certain evidence types (audit logs under Requirement 10, for example), and your acquirer may impose its own retention rules for completed SAQs, so check your merchant agreement.
PCI DSS compliance is validated annually. Complete a new SAQ-D and AOC every year, incorporating environmental changes, new system components, and updated scan and test results. Quarterly ASV scans continue throughout the year; the annual SAQ doesn’t replace them.
Failing to maintain compliance or submit your annual SAQ can trigger escalating monthly fines imposed by the card brands through your acquirer. These typically start in the range of $5,000 to $10,000 per month and can climb to $100,000 per month if the lapse extends beyond six months. Persistent non-compliance can also mean increased transaction fees, restrictions on your ability to process cards, or termination of your merchant account. The card brands don’t fine you directly; the penalties flow through your acquirer, who passes them along and sometimes adds fees on top.