Payment gateway requires PCI DSS compliance — is SAQ-A enough, or do we need an audit?

You can proceed step by step: 1) Download the up-to-date PCI DSS AOC document from your payment provider's dashboard. 2) Obtain the latest SAQ-A document from the official PCI Security Standards Council website. 3) Answer the questions, have an officer of your company sign it, and upload the form to your payment provider's portal.

We process an annual volume of 1.5 million EUR, and we got a similar notice. At first, some consultants quoted us around 5,000 EUR for an audit. We spoke with our payment provider's technical rep, confirmed we use an iframe, filled out the SAQ-A form ourselves, and it got approved. It didn't cost us a single penny.

If you're using an iframe on your site, watch out for the new requirements introduced in PCI DSS v4.0. You are now required to verify the integrity and authorization of all third-party JavaScript running on the payment page. Even with SAQ-A, these controls became mandatory to mitigate the risk of malicious scripts leaking from the parent page into the payment iframe.

Exactly which integration method is your payment provider using? For instance, is it a direct redirect, an inline iframe, or a JS library that tokenizes card details? If you're doing tokenization via JavaScript, the bank might sometimes classify it as SAQ A-EP.

To clarify your standing, run these checks: 1) Is the source code for the card input field actually loaded from the payment provider's domain? 2) Do any request parameters in your server logs contain card numbers or CVVs? 3) Is your merchant level listed as Level 4 in your payment provider's dashboard? If all three check out, you don't need an external audit.

Risk teams at payment institutions sometimes send out automated canned emails demanding a QSA audit as if you were a Level 1 merchant. Don't waste money on external firms without questioning it first. We got a similar letter last year; we just replied, "We don't store card data on our systems we're submitting an SAQ-A," and that was the end of it.

SAQ-A is more than enough for your setup. With a 350,000 euro annual turnover, there is zero legal basis to force an independent audit on you. Don't fall for the hefty quotes from QSA firms; just fill out the form yourself and submit it.

we had the exact same sare two years ago; the tone of the email was so harsh I thought a massive fine was right around the corner then once we sat down and actually read the form with a clear head it took half a day. anyway the payment providers support docs even spelled out how to answer each question.

Thanks for posting.

The most overlooked point about pci dss compliance is this: An untested backup is not a backup.

I partly agree, partly disagree. Just because everyone does it doesn't mean it's right.

If I were you, I'd go this route.

We've heard this a lot but it never happened like that for us. I mean most incidents start with a leaked password, not a vulnerability.

If you have questions write them; Ill answer as best I can.

here's how it went for us. just because everyone does it doesn't mean it's right.

this is my oppinion Im not claiming its absolute truth.

Noted, thanks. Security isn't absolute; it's about making attacks not worth the effort.

I'm also curious if anyone does it differently.

Great work. Trying to do this alone is the most expensive way.

I'm also curious if anyone does it differently.

Correct in theory, but it doesn't work that way in practice. Start with a small trial; don't commit to everything at once.

If you have questions, write them; I'll answer as best I can.

Three different views emerged, they all complement each other... People defend habits not processes... Resistance comes from there.

Of course, it varies if your situation is different.

The discussion got scattered, let me summarize. anyway if you get three different answers on a topic the question was asked wrong.

If you post the result here, it will help others too.