SAQ A — Card-not-present, fully outsourced

Write down how your business handles security. One short document, reviewed once a year, signed off by a director. It doesn't need to be 80 pages.

Evidence: Signed policy document, last-reviewed date

Name the person who owns PCI in your business. Could be the finance director, ops manager, whoever. Just one named person, written down.

Evidence: Org chart or job description naming the role

List every supplier that touches card data — your payment processor, hosting provider, the iframe vendor. Get their AOC (Attestation of Compliance) once a year.

Evidence: Supplier list + current AOCs on file

Your website redirects customers to your payment processor's page, OR uses an iframe served entirely from the processor. You never see the card number, not even briefly.

Evidence: Architecture diagram showing redirect/iframe flow

If you have any physical card terminals (e.g. for backup), keep a list of them, check them weekly for tampering, and train staff on what to look for.

Evidence: Terminal inventory + inspection log

Two pages is fine. Who do you call if you suspect a breach? How do you contact the card brands? Test it once a year with a tabletop exercise.

Evidence: Plan document + last tabletop exercise notes

If your processor or hosting provider sends a security bulletin, somebody reads it within 24 hours. Set up an inbox alias if you have to.

Evidence: Email alias / monitoring setup

Your contract with the payment processor and any other PCI-relevant supplier needs to specifically say they're responsible for the security of cardholder data they handle.

Evidence: Signed contracts referencing PCI responsibilities

Keep a one-row spreadsheet per supplier: name, what they do, their PCI level, when their AOC was last issued, when it expires.

Evidence: Supplier compliance tracker spreadsheet

If yes — even occasionally — SAQ A doesn't cover it. The agent typing the card number into a CRM brings the entire call into PCI scope. You need a descope solution like Paytia, or you'll need to complete SAQ D instead.

Evidence: Either no phone payments, or a phone-payment descope solution in place