PCI DSS v4.0.1 Self-Assessment Questionnaire (SAQ D for Service Providers)

Why does it matter?

Service providers hold, or can affect, the account data of many merchants at once, so the Council gives them no shortcut: SAQ D for Service Providers is the only SAQ option for service providers (Service Provider Eligibility Criteria). It asks for more than a merchant SAQ in three ways: a scope declaration per service in Part 2a, the environment evidence of Section 2a, and a written description of results for every requirement. It also carries the service-provider-only requirements, including the Requirement 12.9.1 obligation to give customers written acknowledgment of responsibility for the account data the provider stores, processes or transmits on their behalf, and Appendix A1 for providers whose customers share infrastructure.

Key benefits include:

• One SAQ, no eligibility test

Any service provider that a payment brand deems eligible to self-assess uses this form; the question is not which SAQ but whether a Report on Compliance is required instead.

• Scope declared per service

Part 2a lists the services included and excluded, by type (hosting, managed services, payment processing, payment gateway or switch and others), and Part 2g is completed once for each service assessed, with a Justification for Approach for every Not Applicable or Not Tested answer.

• Environment evidence up front

Section 2a collects network diagrams, the storage-of-account-data table with encryption and access logging per data store, any sensitive authentication data storage, in-scope system component types with counts and vendors, and the quarterly ASV scans with Attestations of Scan Compliance.

• Results described, not just ticked

The Service Provider Required Reporting column requires a brief description of how testing and evidence demonstrate each response, including which aspect a compensating control covered and why any requirement was excluded.

• Multi-tenant controls included

Appendix A1 is answered in full: logical separation (A1.1.1), per-customer access (A1.1.2, A1.1.3), penetration testing of separation at least once every six months (A1.1.4), per-customer audit logs (A1.2.1), forensic support (A1.2.2) and secure incident reporting with remediation per 6.3.1 (A1.2.3).

How does it work?

Section 1 is Parts 1 and 2 of the AOC: the assessed entity and assessor (1a, 1b), Scope Verification (2a), how the business handles account data and can otherwise affect its security (2b), the environment and segmentation (2c), in-scope locations (2d), PCI SSC validated products in use (2e), third-party service providers, to which Requirement 12.8 applies (2f), and the Summary of Assessment (2g) with rows for Requirements 1 to 12, Appendix A1 and Appendix A2. The five completion steps then follow: confirm that SAQ D is the only SAQ option, confirm scope, assess, complete Sections 1, 2a, 2b and 3, and submit the SAQ and AOC with any requested documentation to the payment brand or acquirer.

Section 2b mirrors the PCI DSS wording for all twelve requirements with Expected Testing and the same five responses as the merchant form (In Place and In Place with CCW, Not Applicable, Not Tested, Not in Place), each followed by the Describe Results box. Not Applicable must be verified and explained in Appendix C. Not Tested covers requirements excluded without consideration, for instance a physical storage provider confirming only the Requirement 9 controls for its facility; each is explained in Appendix D and makes the assessment Partial. Compensating controls need the Appendix B worksheet; a legal restriction is reported as Not in Place with the statute or regulation described; the customized approach is not supported in any SAQ.

Appendix A1 applies to multi-tenant service providers, which PCI DSS describes as providers whose customers share system resources, infrastructure, applications or databases; providers of shared data center space alone are not covered. Appendix A2 holds A2.1.2, a Risk Mitigation and Migration Plan for providers with connection points to POS POI terminals using SSL or early TLS, and A2.1.3, a secure service offering; Appendix A3 applies only to designated entities. Section 3 records Full or Partial, the compliance status, the acknowledgement that SAQ D Version 4.0.1 was completed per its instructions, the executive officer signature, QSA and ISA roles and, on request, a Part 4 action plan with rows for Requirements 1 to 12, A1 and A2.

Key Elements

• Service Provider Eligibility Criteria

Applies to all service providers defined by a payment brand as eligible to complete an SAQ; the only SAQ option for service providers.

• Part 2a: Scope Verification

Services included and not included in the assessment, by category, with an explanation for anything excluded; Part 2b describes how the provider can impact customer account data.

• Section 2a: Details about Reviewed Environment

Network diagrams, storage of account data and SAD, in-scope system component types, quarterly ASV scan results for the last twelve months and the Attestations of Scan Compliance.

• Section 2b: Requirements 1 to 12 with Describe Results

The full PCI DSS requirement set, each with a required description of testing and evidence, including the service-provider-only items 3.6.1.1, 3.7.9, 8.2.3, 8.3.10, 8.3.10.1, 10.7.1, 11.4.6, 11.5.1.1, 12.4.1, 12.4.2, 12.4.2.1, 12.5.2.1, 12.5.3, 12.9.1 and 12.9.2.

• Appendix A1: multi-tenant service providers

A1.1, protect and separate all customer environments and data; A1.2, facilitate logging and incident response for all customers.

• Appendix A2 and Appendix A3

A2.1.2 and A2.1.3 for providers connected to POS POI terminals on SSL or early TLS; A3 (Designated Entities Supplemental Validation) only when a payment brand or acquirer designates the entity.

• Section 3 and Part 4

Full or Partial; the status chosen from Compliant, Non-Compliant and Compliant but with Legal exception; executive officer attestation and the action plan covering Requirements 1 to 12, A1 and A2.

What does it cover?

The form covers every service provider that stores, processes or transmits account data on behalf of others, or that can affect the security of customer account data, and that a payment brand allows to validate by self-assessment rather than by a Report on Compliance. The categories in Part 2a show the breadth: hosting providers (including multi-tenant service providers and 3-D Secure hosting), managed services such as systems security and terminal management, payment processing by channel, payment gateways and switches, clearing and settlement, issuer processing, fraud and chargeback, loyalty, billing, records management and others. Each service is scoped, assessed and summarized separately in Part 2g. Merchants cannot use this SAQ; they have SAQ D for Merchants and the shorter merchant questionnaires.

What are its objectives?

The questionnaire is built so that a service provider can demonstrate that:

The services assessed, and those left out, are stated plainly in Part 2a, with one Part 2g summary per service.

The environment is documented before testing: diagrams, data stores, component types and twelve months of ASV scans in Section 2a.

Every requirement, including the service-provider-only items, has a response and a written description of the evidence behind it (Section 2b).

Customers receive the written acknowledgment of responsibility that Requirement 12.9.1 requires, and multi-tenant customers are separated, logged and supported under Appendix A1.

An executive officer attests the outcome in Part 3b and any Non-Compliant requirement carries a remediation date in Part 4.

Framework in Context

SAQ D for Service Providers mirrors PCI DSS v4.0.1 (June 2024) and sits beside the Report on Compliance completed with a Qualified Security Assessor; the choice between them belongs to the payment brands and acquirers that run the compliance programs. It is also the document merchants rely on when reviewing their providers: the Attestation of Compliance it produces is what a merchant checks under Requirement 12.8.4 when monitoring a provider's PCI DSS status at least once every 12 months, and 12.8.5 asks both parties to record which requirements each manages. Requirements 12.8 and 12.9 define that relationship, and the Appendix A1 overview adds that each customer of a multi-tenant provider remains responsible for its own compliance.

Common Framework Mappings

Service providers usually answer several assurance programs at once, so they map the SAQ D requirements, Appendix A1 and Appendix A2 to the controls, owners and evidence they already maintain, and reuse them for the annual attestation and for customer due diligence. The list below is indicative; the payment brand or acquirer evaluates the completed SAQ and AOC, not the mapping.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

FedRAMP Rev. 5

HIPAA

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2