Which SAQ type applies to a service provider using only web-based virtual terminals?

Which SAQ type applies to a service provider using only web-based virtual terminals?

• A. SAQ A
• B. SAQ B
• C. SAQ D
• D. SAQ C-VT

Answer: (C)

Understanding how card data moves and where it resides guides which SAQ applies. If you’re a service provider and your cardholder data processing happens only through web-based virtual terminals, there isn’t a traditional POS device or local storage of CHD on your systems. That footprint isn’t fully covered by the narrower categories, so you follow the broader designation that encompasses environments not captured by the other SAQs. SAQ D is designed for service providers and similar setups, requiring you to assess controls across the entire card data environment you manage, including access, network segmentation, and monitoring. This is why SAQ D is the best fit for a service provider using only web-based virtual terminals. If you were a pure merchant using only a web-based terminal and no other CHD processing, a more targeted SAQ could apply, but for a service provider, the broader SAQ is appropriate.

Understanding how card data moves and where it resides guides which SAQ applies. If you’re a service provider and your cardholder data processing happens only through web-based virtual terminals, there isn’t a traditional POS device or local storage of CHD on your systems. That footprint isn’t fully covered by the narrower categories, so you follow the broader designation that encompasses environments not captured by the other SAQs. SAQ D is designed for service providers and similar setups, requiring you to assess controls across the entire card data environment you manage, including access, network segmentation, and monitoring. This is why SAQ D is the best fit for a service provider using only web-based virtual terminals. If you were a pure merchant using only a web-based terminal and no other CHD processing, a more targeted SAQ could apply, but for a service provider, the broader SAQ is appropriate.