Frequently Asked Questions

< Back to search page

Are merchants required to perform the “Expected Testing” in the SAQs?

FAQ Response

Yes. The Expected Testing column of each SAQ provides a high-level description of the types of testing activities that should be performed in order to determine whether a requirement is in place. The individual(s) responsible for performing the self-assessment (that is, the merchant or service provider, or their QSA) is expected to perform these testing activities.

The instructions in the “Expected Testing” column are based on the testing procedures in the PCI DSS, and allows the entity to determine whether the requirement is properly implemented, thus enabling them to accurately complete the SAQ.  Refer to the section “Understanding the Self-Assessment Questionnaire” in the applicable SAQ for further guidance.

 

January 2015
Article Number 1316

Related Articles

Can SAQ eligibility criteria be used for determining applicability of PCI DSS requirements for onsite assessments?

Why is there a different approach for Direct Post implementations than for iFrame and URL redirect – what are the technical differences and how do they impact the security of e-commerce transactions?

Who can use SAQ P2PE?

How is the payment page determined for SAQ A merchants using iframe?

Why is SAQ A-EP used for Direct Post while SAQ A is used for iFrame or URL redirect?