Which SAQ applies to a merchant with a standalone payment application connected to the Internet?

Which SAQ applies to a merchant with a standalone payment application connected to the Internet?

• A. SAQ B
• B. SAQ P2PE
• C. SAQ A-EP
• D. SAQ C

Answer: (D)

The main idea tested is how the PCI SAQ categories map to where card data flows and where it’s stored in your environment. A standalone payment application that is connected to the Internet sits in a category that covers payment application systems connected to the Internet, with no electronic storage of cardholder data beyond what the payment app handles. That makes it different from a non‑internet‑connected terminal setup (which would point to the B category), and it’s not an e‑commerce outsourcing scenario (A/A‑EP) or a P2PE scenario (which would require a validated point‑to‑point encryption solution). So the correct SAQ is the one designed for payment application systems connected to the Internet.

The main idea tested is how the PCI SAQ categories map to where card data flows and where it’s stored in your environment. A standalone payment application that is connected to the Internet sits in a category that covers payment application systems connected to the Internet, with no electronic storage of cardholder data beyond what the payment app handles. That makes it different from a non‑internet‑connected terminal setup (which would point to the B category), and it’s not an e‑commerce outsourcing scenario (A/A‑EP) or a P2PE scenario (which would require a validated point‑to‑point encryption solution). So the correct SAQ is the one designed for payment application systems connected to the Internet.