PCI DSS / C
For merchants with Internet-connected payment application systems and no electronic account data storage, subject to the specific SAQ C eligibility criteria.
Who it is for
SAQ C covers specific payment application environments, such as point-of-sale systems. The application, Internet connection and separation from other systems are reviewed together. A POS application alone does not establish eligibility.
Key eligibility criteria
- The environment includes a payment application and an Internet connection on the device or local network.
- The payment application and Internet connection are not connected to other systems in the environment; the required separation must be documented.
- The point-of-sale environment is limited to one location and is not connected to other premises. Account data is not stored electronically.
- This path does not apply to e-commerce. Support access and every additional connection must be checked against the complete questionnaire.
Payment flow
- 01Transaction at point of sale
- 02Payment application over Internet
- 03Provider authorization
Illustrative overview. Your actual data flow must be reviewed before choosing an SAQ.
Before completing your SAQ
Collect the application architecture, network diagram and support access details. Review logs, backups and exports to establish that electronic account data is not retained.
These criteria are a summary and do not replace the complete questionnaire. Confirm every criterion in the applicable version and the validation method with your acquirer or accepting entity.
