What Actually Changed in SAQ A

The Payment Card Industry Data Security Standard (PCI DSS) has updated SAQ A, simplifying compliance in some areas while tightening security expectations in others. These changes primarily reflect the realities of modern eCommerce environments, especially those relying on third-party service providers.

Summary of Key Changes

The Council removed two burdensome monitoring requirements and added a stricter eligibility criterion focused on overall site security.

Removed Requirements

New Eligibility Criteria

SAQ A now includes a critical eligibility update:

• Full-site security is now mandatory – not just the checkout or payment pages.
• Merchants must formally attest that their entire website is not vulnerable to script-based attacks, such as JavaScript injection or formjacking.

This means SAQ A is now restricted to merchants whose websites are hosted and maintained in a completely outsourced environment, where no cardholder data is touched, stored, or processed by the merchant systems.

Why These Changes Matter

The elimination of Requirements 6.4.3 and 11.6.1 was driven by practicality:

• Manual monitoring is resource-intensive and error-prone.
• Automated tools for detecting third-party script changes or form modifications did not exist or were unaffordable for small merchants.
• The ROI of these controls was considered low compared to their complexity.
• Create multi-format content (text, audio, video) to appeal to multi-modal search engines.

On the other hand, the new eligibility criterion tightens the scope of who can claim SAQ A status:

• This shift reflects the growing threat of JavaScript-based attacks like Magecart and formjacking.
• The PCI Council is prioritizing full-site security hygiene over incomplete or unscalable technical monitoring.

Updated SAQ A Compliance Table (2025)

What Merchants Need to Do Now

To remain eligible for SAQ A:

• Reassess your hosting setup – Ensure your entire site is hosted by PCI-compliant third parties.
• Conduct a full-site vulnerability scan – Particularly for script-based exploits (e.g., formjacking, JavaScript injection).
• Document your environment – Be prepared to show that no part of your infrastructure processes or stores cardholder data.
• Use content security policies (CSP) and subresource integrity (SRI) to harden your website against script injection attacks.

Major PCI DSS Compliance Shift: Who Wins and Who Loses?

Recent updates to PCI DSS (Payment Card Industry Data Security Standard) guidelines have significantly changed how businesses handle customer payment data. These changes primarily impact how different merchants qualify for Self-Assessment Questionnaires (SAQs), which are used to validate compliance.

Winners: Iframe and Redirect Checkout Users

Merchants who rely on iframes or redirects for checkout now enjoy simplified compliance processes. These methods transfer customers to a third-party hosted environment (e.g., a secure payment gateway), reducing the merchant’s exposure to sensitive payment data.

Benefits:

• Streamlined Compliance: Retain SAQ A eligibility.
• Lower Costs: Avoid costs associated with deep compliance checks.
• Reduced Overhead:
• No need for script integrity monitoring.
• No need to track every third-party script on the checkout page.
• No manual validation of all embedded external scripts.
• No extensive documentation to support ongoing monitoring.

By using redirection or embedded iframes, you minimize your PCI scope and remain eligible for SAQ A, which has fewer than 30 requirements and no scanning obligations.

Losers: Direct Payment Form Implementers

If your checkout collects cardholder data directly, even if it's only temporarily before forwarding to a payment processor, you now fall under SAQ A-EP eligibility.

This reclassification significantly expands your compliance burden.

Implications:

• You’re no longer eligible for SAQ A.
• You must now complete SAQ A-EP, which includes over 140 security requirements.
• These controls include:
• Quarterly vulnerability scans
• Annual penetration testing
• Strict change control processes
• Enhanced network security configurations
• Security incident response planning

This shift dramatically raises the cost and complexity of remaining compliant.

SAQ Type Comparison Table

Key Takeaway

• Outsource whenever possible. If your platform allows it, using iframe or redirect methods to process payments keeps you in the lower-complexity SAQ A category. Direct integrations may give you more control over UX, but come with steep compliance trade-offs and higher risk exposure.
• Stay up to date with evolving PCI DSS versions—v4.0 now in effect—introducing stricter guidelines and custom control validations. Businesses must weigh UX flexibility against compliance simplicity and security assurance.

Immediate Action Required Before March 31, 2025

PCI DSS 3.2.1 is retiring. If your business accepts card payments online, you must transition to PCI DSS 4.0 and update your Self-Assessment Questionnaire (SAQ) compliance path before March 31, 2025 to avoid penalties, fines, or disrupted payment services.

Step 1: Identify Your Payment Integration Method

Understanding how your website processes payments determines your compliance path:

Step 2: Determine Your New SAQ Type Under PCI DSS 4.0

Use your payment integration method to determine which SAQ applies going forward:

Step 3: Implement Required Security Measures (Updated for PCI DSS 4.0)

For SAQ A (Iframe/Redirect):

You must now meet stricter technical standards even if you don’t handle card data directly:

Protect Against JavaScript Injection Attacks

• Implement subresource integrity (SRI) for third-party scripts
• Limit inline JavaScript

Set a Strict Content Security Policy (CSP)

• Define approved domains for scripts, styles, and images

Enforce Secure HTTP Headers on All Pages:

• Content-Security-Policy
• Strict-Transport-Security
• X-Content-Type-Options
• Referrer-Policy

Keep All Software and Plugins Updated

• Regularly patch CMS, themes, extensions, and dependencies

For SAQ A-EP or SAQ D (Direct Form Integration):

You are now considered a high-risk handler of cardholder data and must:

• Schedule Quarterly External Vulnerability Scans by an approved scanning vendor (ASV)
• Conduct Annual Penetration Testing
• Including both internal and external networks
• Document and Maintain Network Segmentation
• Isolate cardholder data environment (CDE) from other networks
• Implement Strong Access Controls
• Role-based access, MFA, logging, and monitoring
• Review Risk and Security Programs Annually
• Policies, training, incident response plans

Summary Table: PCI SAQ Types and Requirements (2025)

• Audit your payment integration
• Determine your SAQ type
• Upgrade security controls
• Document your compliance path
• Schedule scans/tests if needed
• Submit updated SAQ to your payment provider

Website Security Requirements (Updated 2025)

Maintaining robust website security is critical for protecting customer data and ensuring compliance with global data protection regulations (e.g., GDPR, PCI DSS, CCPA). You are responsible for confirming that no sensitive payment data is exposed or accessible, including through third-party integrations. This requires securing your entire website, not just payment or checkout pages.

Essential Website Security Measures

1. Content Security Policy (CSP)

A powerful browser-based security layer to prevent malicious content from executing.

• Block unauthorized script execution using script-src directives.
• Whitelist only trusted sources such as your own domain or verified CDNs.
• Mitigate XSS (Cross-Site Scripting) and code injection attacks.

2. HTTP Security Headers

HTTP response headers add extra layers of protection by instructing browsers how to behave.

3. Regular Platform & Plugin Updates

• Use the latest stable version of your eCommerce or CMS platform (e.g., Magento, WooCommerce, Shopify).
• Update all plugins, extensions, and themes to patch known vulnerabilities.
• Monitor CVE databases (Common Vulnerabilities and Exposures) for new threats.

4. Script Management & Third-Party Audits

• Audit all third-party JavaScript integrations (analytics, chatbots, marketing tools).
• Remove unused or outdated scripts to reduce the attack surface.
• Continuously monitor for unauthorized changes, such as crypto miners or malicious redirects.