The Card-Security Questionnaire — What the Smallest Merchants Must Do
Last verified: October 2026
PCI compliance sounds like a job for a consultant. For most small shops, it isn't. This plain-English guide shows which short questionnaire fits you and how to complete it yourself. Rather have a hand? My number is (330) 200-8042.
The Card-Security Questionnaire, at a Glance
Every business that takes cards agrees to follow the card-security standard, PCI DSS, and confirms it once a year with a short Self-Assessment Questionnaire (SAQ). Which SAQ you use depends on how you take cards, not how big you are — and if you use Square, Clover, Toast, or Shopify with their own listed hardware, the system does most of the work. This guide walks you through it in plain English. There's a printable 29-page version up top.
Common Questions
1 What is PCI DSS?
It's the Payment Card Industry Data Security Standard — the card networks' security rules that every business taking cards agrees to follow. As of late 2026 the current version is v4.0.1. Confirm the current version with your processor.
2 Do I have to do this if I'm a tiny shop?
Yes, but the smallest setups get the shortest form. The questionnaire is based on how you take cards, not your size. Confirm your exact SAQ type with your processor.
3 Do I need to hire a consultant?
Usually no. A small shop on a mainstream POS with a listed reader lands on a short SAQ it can complete itself in about an hour. Paid help makes sense mainly if you store card data or face a formal assessment.
4 Which SAQ applies to me?
It depends on your setup — common ones are SAQ A (all handling outsourced), SAQ P2PE (a listed encrypting terminal, the shortest in-person one), and SAQ B-IP, C, or C-VT. SAQ D is the catch-all if you store card data. Confirm yours with your processor.
5 What's my part if the POS does most of the work?
Strong, unique passwords; multi-factor authentication; and never storing full card numbers yourself. Use card-on-file tokens for regulars instead — our deposits-and-cards-on-file guide shows how.
6 Is there a fee if I skip it?
Often yes — a PCI non-compliance fee, usually larger than the regular PCI fee. Completing your questionnaire normally stops it. Check your statement to see which you're paying.
Would You Rather I Just Help?
The card-security questionnaire scares more owners than it should. I'll sit with you at your counter, figure out which short form fits how you take cards, and help you complete it — strong passwords, MFA, and no stored card numbers — with nothing to sell you and no commission from anyone. For the exact SAQ, we'll confirm with your processor. $99 flat for a visit, 30-day come-back-free.
Would you rather I just do this for you?
No shame in it — plenty of folks would rather hand it off, and that's what I'm here for. I'll come to your home, set it up right, and make sure it's working before I leave. Flat $99 per visit — no jargon, no upsell, and every visit is 30-day come-back-free.
Not a hardware job? I can often fix it remotely for $49 — a secure screen-share, up to 2 hours, that you watch the whole time and can end whenever (included free for $39/mo Support Plan members, and it counts toward the $99 if it turns out I need to come out).