PCI Compliance Questionnaires [Complete Guide]

If you fall into the Level 1 category, you are a major merchant or service provider that collects credit card information and processes over 6 million transactions each year—which means you are subject to the highest PCI compliance standards. 

For Level 1 merchants, you’ll have to complete:

• An annual risk assessment using the appropriate SAQ.
  • An Attestation of Compliance (AOC), which certifies that you are eligible to perform the SAQ.
• An annual audit completed by a qualified PCI auditor.
• Quarterly scans on your network and infrastructure by an approved third-party vendor.

You may also qualify as a Level 1 merchant if you process more than 2.5 million American Express transactions, or if you have had a cyberattack or data breach that resulted in compromised credit card data. It’s important to note that you only need one data breach and one piece of credit card data stolen to qualify into this category. 

You are a large-scale merchant or service provider who collects credit card information and processes between 1 million to 6 million transactions each year. You can also qualify as a Level 2 merchant if you process between 50,000 and 2.5 million American Express transactions. 

If you fall into the Level 2 category, you must complete: 

• An annual risk assessment using the appropriate SAQ.
• Quarterly scans of your network by a third-party vendor, although not always required in some cases.

You are a medium to large-scale merchant or service provider who collects credit card information and processes between 20,000 and 1 million VISA and Mastercard eCommerce transactions each year. You can also qualify as a Level 3 merchant if you process fewer than 50,000 American Express transactions each year. 

If you fall into the Level 3 category, you must complete:

• An annual risk assessment using the appropriate SAQ.
• Quarterly scans of your network by a third-party vendor, although not always required in some cases.

You are a small-scale merchant or service provider who collects credit card information and processes less than 20,000 eCommerce transactions each year and less than 1 million total Visa and MasterCard transactions. American Express transactions are not applicable for Level 4 merchants.

If you fall into the Level 4 category, you must complete:

• An annual risk assessment using the appropriate SAQ.
• Quarterly scans of your network by a third-party vendor, although not always required in some cases.

Diagram showing the journey of a card payment transaction from the customer to a merchant bank account.

There are 12 security standards per the PCI DSS framework that all merchant levels must have across their internal and external networks, including:

1. Installing and maintaining a firewall configuration to protect cardholder data.
2. Not using vendor-supplied defaults for your system passwords and other security parameters.
3. Protecting stored cardholder data.
4. Encrypting transmission of cardholder data across open and public networks.
5. Using and regularly updating your antivirus software.
6. Developing and maintaining secure systems and applications.
7. Restricting access to cardholder data by business need-to-know basis.
8. Assigning a unique ID to each person with computer access.
9. Restricting physical access to credit card data.
10. Tracking and monitoring all access to network resources and cardholder data.
11. Regularly testing security systems and processes.
12. Maintaining a security policy that addresses information security for employers and contractors.

Another security standard that you can follow is to find a processor or gateway that will house your credit card data in a token. 

Tokenization helps against cyberattacks by replacing the customer’s primary account number (PAN) with a string of randomly-generated numbers (known as a token). Tokens can then be passed through the Internet or the wireless networks needed to process a payment without exposing PANs.

When searching for a tokenization processor, be sure to choose a PCI-compliant organization. 

There are eight different types of SAQs that you need to select from based on your PCI compliance level and your merchant network. 

View Table

Maintaining PCI compliance is important for merchants at all levels, as it will help you protect your business against cyberattacks, safeguard sensitive customer data, and avoid fines that could be between $5,000 and $100,000 per month. To ensure you are meeting compliance standards, you can perform vulnerability and penetration scans based on which type of SAQ you complete.  

A vulnerability scan allows you to scan your system network and applications to look for weaknesses in your operating system, services, and devices that could be targeted by hackers. It’s beneficial to perform vulnerability scans once a quarter, and you must submit a passing scan to your processor for each card type you accept. 

Penetration scans are performed annually on top of your quarterly vulnerability scans. These scans are used to exploit any vulnerabilities in your code or network that may pave the way for hackers to gain access to sensitive information. Penetration scans utilize real users who attempt to dig into your system to find any weaknesses. While these tests can be expensive, they are crucial to ensuring your network stays secure. 

Note: You can perform penetration scans internally, but these tests must be conducted by a qualified user who is independent of the system they are checking. 

Liquid Web’s Security Team performs these penetration tests for Liquid Web customers.