QSA Assessment Services
PCI SAQValidated.Simplified.
Prepare your PCI DSS Self-Assessment Questionnaire with QSA guidance. 443 Labs helps eligible merchants and service providers confirm the assessment route, review control evidence, resolve gaps and complete the applicable SAQ and AOC documentation.
Common SAQ types · Confirm all eligibility criteria
Assessment Approach
Scope Validation
Confirm eligibility for the selected SAQ type based on business model and data flow. We work with you to establish whether your current payment environment and controls qualify for the chosen SAQ — avoiding costly misclassification.
Documentation Review
Review completed SAQ, network diagrams, policies, and related documents. Our QSAs examine every piece of required documentation to ensure completeness, accuracy, and alignment with current PCI DSS v4.0.1 requirements.
Control Evidence Verification
Validate implementation of required controls using submitted evidence. We cross-reference your technical and procedural controls against the specific requirements of your SAQ type, flagging gaps before they become findings.
Interviews & Observations
Conduct staff interviews and observe processes to verify SAQ accuracy. On-site or remote walkthroughs with relevant personnel ensure that documented controls reflect actual day-to-day operations.
Gap Identification & Remediation
Identify non-compliant areas and guide remediation efforts. Unlike self-service tools, our QSAs stay with you through every finding — providing direct remediation guidance and retesting resolved controls.
Final Attestation Review
Review the completed SAQ and applicable AOC, confirm the assessed scope and supporting evidence, and explain the required signatories. The final documentation records the actual assessment results for submission to the requesting party.
Engagement Scope
Everything guided.
Nothing overlooked.
Agree the engagement scope before assessment: SAQ eligibility review, control evidence, gap remediation support and the applicable SAQ/AOC documentation. The final attestation reflects the implemented controls and assessment results.
For the initial review, prepare a diagram for each payment channel, your payment provider’s implementation instructions and compliance evidence, previous SAQ/AOC documents, and the reporting request from your acquirer or payment brand. Identify who maintains the payment page, devices, networks and policies.
Agree the eligibility rationale, evidence review, gap list and SAQ/AOC preparation in the engagement. Technical testing and remediation work depend on your environment and the agreed scope. The PCI DSS assessment guide explains how these dependencies affect cost and timing.
Expert identification of the correct SAQ type for your business model
Evidence validation and direct gap remediation guidance
Staff interview facilitation and process observation walkthroughs
Formal SAQ and AOC delivery with defensible supporting artifacts
Why 443 Labs
Other firms vs.443 Labs.
- ×Self-guided SAQ with no expert oversight
- ×Risk of selecting the wrong SAQ type
- ×No remediation support on findings
- ×Failed attestation with no clear path forward
- Expert SAQ type identification from day one
- Full QSA-guided validation against PCI DSS v4.0.1
- Gap remediation guidance and evidence review
- SAQ and AOC preparation reflecting assessment results
SAQ Types
Which SAQ applies
to your business?
Start with your actual payment flows and confirm the accepted reporting route with your acquirer or payment brand. These common questionnaire types are a starting point; industry examples are not eligibility rules, and the list is not exhaustive.
A hosted iframe, Direct Post form and full redirect can look similar to a customer while exposing different systems to account data. Retain a payment-flow diagram and provider implementation instructions before choosing SAQ A or SAQ A-EP.
Use the current PCI SSC questionnaires and eligibility criteria. For embedded forms, review FAQ 1588 on script-security eligibility with your payment provider.
Prepare your assessment evidenceCommon Questions
How do I choose the correct PCI DSS SAQ?
Map each payment channel, the systems that handle account data, and the responsibilities of your payment providers. Compare that environment with every eligibility criterion in the current questionnaire. Confirm with your acquirer or payment brand that SAQ validation is accepted and which form they require. Industry labels and transaction counts alone do not establish eligibility.
Can an organization complete multiple SAQs if it uses different payment channels?
Ask your acquirer or payment brand whether separate SAQs or a combined assessment is appropriate. Each channel must meet the eligibility criteria of its questionnaire; separate SAQs also require adequate segmentation between the channels. Document the covered environments in the AOC. A business should not choose multiple short questionnaires simply to omit requirements from a connected environment.
How often should a business reassess its SAQ type?
At least annually, or whenever there's a significant change in how cardholder data is handled — such as adopting new payment technologies or platforms.
What is the difference between SAQ A and SAQ A-EP?
For e-commerce SAQ A, the provider must supply all elements that collect or process payment account data, and every other eligibility criterion must be met. A provider-hosted redirect or iframe may fit that model. In Direct Post, the merchant supplies some or all of the collection page while data is sent from the browser to the processor; SAQ A-EP may apply if all of its criteria are met. The integration name alone is not enough to select a questionnaire.
Does outsourcing checkout remove all merchant PCI DSS responsibilities?
No. Verify the provider's compliance evidence, document the services covered and agree who operates each applicable control. The merchant must still meet its questionnaire's eligibility and requirements. A provider attestation or tokenization claim alone does not establish the merchant's compliance.
Can a service provider use an SAQ instead of a full ROC (Report on Compliance)?
A service provider can use SAQ D for Service Providers when the applicable payment-brand reporting program permits SAQ validation. Merchant questionnaires such as SAQ A and SAQ A-EP are not service-provider validation forms. Confirm the required assessment route with the party requesting validation; there is no single transaction threshold that governs every payment-brand program.
What changed for SAQ A payment-page scripts?
The revised SAQ A includes a script-security eligibility condition for merchants using an embedded provider payment form. PCI SSC FAQ 1588 explains two routes: deploy suitable script-attack protections, or obtain confirmation that the payment provider's solution protects the page when implemented as instructed. This specific condition does not apply to redirect-only or fully outsourced payment-link flows; other SAQ A eligibility criteria and requirements still apply.
Reference guidance: SAQ A versus SAQ A-EP, multiple payment channels, and confirming SAQ eligibility. Your assessment documentation must reflect the implemented environment.
Also Explore
Related services
Speak with a QSA today. No obligation, no generic sales pitch — just a direct conversation about your payment environment and which SAQ path fits your business.
From the Blog