PCI DSS v4.0.1 Self-Assessment Questionnaire (SAQ A-EP) — Cardholder Data Security Controls for E-Commerce Payment Pages

PCI DSS v4.0.1 SAQ A-EP is designed for e-commerce merchants who outsource all cardholder data functions to PCI DSS compliant service providers but still manage payment page elements. It ensures that payment pages controlling the redirection or capture of cardholder data are properly secured according to PCI DSS requirements.

PCI DSS compliance is mandatory for any organization that stores, processes, or transmits cardholder data. While SAQ A-EP completion demonstrates compliance, the requirement itself is imposed by the payment brands and acquirers, not as an official “certification” but as an attestable validation.

SAQ A-EP applies to e-commerce merchants who outsource all payment processing but maintain control over the web pages that direct customers to third-party payment services. It specifically excludes merchants who do not handle any payment page elements or redirect processes themselves.

SAQ A-EP requires controls such as maintaining secure systems, protecting payment page scripts, implementing vulnerability management, and restricting unauthorized changes to payment pages. Merchants must also ensure security monitoring and ongoing testing for components within their control.

SAQ A covers merchants with entirely outsourced cardholder data environments and no control over payment pages, whereas SAQ A-EP is for merchants who manage payment page elements but outsource the actual card data handling. SAQ A-EP thus involves additional security and monitoring controls for the merchant-managed components.

SAQ A-EP addresses a distinct scenario among PCI DSS Self-Assessment Questionnaires, focusing on e-commerce environments with partial control over payment pages. It has stricter requirements than SAQ A but fewer than SAQ D, reflecting the shared compliance responsibilities.

Ongoing compliance with SAQ A-EP includes regular quarterly vulnerability scans, continuous monitoring of payment page scripts, periodic risk assessments, and maintaining documentation of controls and incident response procedures. Merchants must also keep evidence of compliance for review during audits.

SmartSuite can help organizations manage PCI DSS SAQ A-EP by enabling risk tracking for payment page vulnerabilities, control management of compliance requirements, and structured evidence collection for audits. It supports audit readiness through workflow automation and provides reporting tools that simplify oversight and compliance documentation.