Frequently Asked Questions

< Back to search page

Are merchants required to perform the “Expected Testing” in the SAQs?

FAQ Response

Yes. The Expected Testing column of each SAQ provides a high-level description of the types of testing activities that should be performed in order to determine whether a requirement is in place. The individual(s) responsible for performing the self-assessment (that is, the merchant or service provider, or their QSA) is expected to perform these testing activities.

The instructions in the “Expected Testing” column are based on the testing procedures in the PCI DSS, and allows the entity to determine whether the requirement is properly implemented, thus enabling them to accurately complete the SAQ.  Refer to the section “Understanding the Self-Assessment Questionnaire” in the applicable SAQ for further guidance.

 

January 2015
Article Number 1316

Related Articles

Does the use of expired PTS POI devices meet eligibility criteria for SAQ B-IP?

Can SAQ eligibility criteria be used for determining applicability of PCI DSS requirements for onsite assessments?

Who can use SAQ P2PE?

How is the payment page determined for SAQ A merchants using iframe?

Why is there a different approach for Direct Post implementations than for iFrame and URL redirect – what are the technical differences and how do they impact the security of e-commerce transactions?