{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/pci-dss-v4-0-1-saq-a-script-eligibility-asv-scans/", "item": { "id": "https://update.dsesecurity.com/updates/pci-dss-v4-0-1-saq-a-script-eligibility-asv-scans/", "slug": "pci-dss-v4-0-1-saq-a-script-eligibility-asv-scans", "url": "https://update.dsesecurity.com/updates/pci-dss-v4-0-1-saq-a-script-eligibility-asv-scans/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/pci-dss-v4-0-1-saq-a-script-eligibility-asv-scans.md", "json": "https://update.dsesecurity.com/api/v1/posts/pci-dss-v4-0-1-saq-a-script-eligibility-asv-scans/" }, "title": "SAQ A merchants under PCI DSS v4.0.1: document the script-attack eligibility criterion and quarterly ASV scans", "summary": "PCI SSC’s January 2025 SAQ A update removed payment-page Requirements 6.4.3 and 11.6.1 and targeted risk analysis 12.3.1, but added an eligibility criterion that the merchant’s site is not susceptible to script attacks. The Council said v4.0.1 would be the only active version after v4.0 retired on 31 December 2024.", "format": { "slug": "briefing", "name": "Briefing" }, "priority": { "slug": "advisory", "name": "Advisory" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-18T21:01:10+00:00", "modified_at": "2026-10-18T22:22:08+00:00", "reviewed_on": "2026-10-18", "reading_minutes": 2, "word_count": 406, "potentially_affected": "Merchants that outsource online or mail/telephone-order card payments to PCI DSS validated third parties and validate with SAQ A, and the web developers and hosting providers who maintain their sites.", "dse_recommendation": "DSE recommends that SAQ A merchants document why their website is not susceptible to script attacks that could affect the payment flow before signing their next self-assessment.", "primary_source": { "name": "PCI SSC blog — Important Updates Announced for Merchants Validating to SAQ A (January 30, 2025)", "url": "https://blog.pcisecuritystandards.org/important-updates-announced-for-merchants-validating-to-self-assessment-questionnaire-a", "published_on": null, "authority": "blog.pcisecuritystandards.org" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

PCI SSC’s January 2025 SAQ A update removed payment-page Requirements 6.4.3 and 11.6.1 and targeted risk analysis 12.3.1, but added an eligibility criterion that the merchant’s site is not susceptible to script attacks. The Council said v4.0.1 would be the only active version after v4.0 retired on 31 December 2024.

\n

Source facts

\n

The PCI Security Standards Council’s January 30, 2025 announcement says SAQ A covers merchants that completely outsource account data functions to PCI DSS validated and compliant third parties and keep only paper reports or receipts with account data. The update removed payment-page Requirements 6.4.3 and 11.6.1 and the related targeted risk analysis in 12.3.1, and added an eligibility criterion that merchants confirm their site is not susceptible to attacks from scripts that could affect their e-commerce systems.

\n

The new SAQ A was set to take effect on 31 March 2025, when the October 2024 version was retired. The Council says the change does not remove or diminish the underlying PCI DSS requirements, and that validation requirements are set by compliance enforcing entities such as brands and acquirers.

\n

In an August 2024 Council blog Q&A, which notes that 51 of the 64 new requirements were future-dated to 31 March 2025, a QSA company executive says SAQ A e-commerce merchants are now expected to have an Approved Scanning Vendor scan at least once every three months. The June 2024 v4.0.1 announcement says v4.0.1 adds or deletes no requirements and would be the only active version after v4.0 retired on 31 December 2024.

\n

Applicability

\n

Use this for merchants that validate with SAQ A. Validation rules come from each merchant’s acquirer or other compliance enforcing entity, so confirm with them and check the Council’s document library for current versions.

\n

DSE recommendation

\n

DSE recommends that SAQ A merchants document why their website is not susceptible to script attacks that could affect the payment flow before signing their next self-assessment. Inventory the scripts on pages that redirect to or embed the payment provider, restrict who can change them, keep quarterly ASV scan reports, and confirm with the acquirer that SAQ A still fits.

\n

Verification

\n

Each quarter, confirm a passing ASV scan is on file and the script inventory matches what the payment pages load. Before each annual self-assessment, have the acquirer or a QSA confirm the SAQ type.

\n

Official references

\n

PCI SSC blog — Important Updates Announced for Merchants Validating to SAQ A (January 30, 2025). PCI SSC blog — Future-Dated Requirements of PCI DSS v4.x (August 20, 2024). PCI SSC blog — Just Published: PCI DSS v4.0.1 (June 11, 2024). Reviewed October 18, 2026.

", "content_text": "PCI SSC’s January 2025 SAQ A update removed payment-page Requirements 6.4.3 and 11.6.1 and targeted risk analysis 12.3.1, but added an eligibility criterion that the merchant’s site is not susceptible to script attacks. The Council said v4.0.1 would be the only active version after v4.0 retired on 31 December 2024.\nSource facts\nThe PCI Security Standards Council’s January 30, 2025 announcement says SAQ A covers merchants that completely outsource account data functions to PCI DSS validated and compliant third parties and keep only paper reports or receipts with account data. The update removed payment-page Requirements 6.4.3 and 11.6.1 and the related targeted risk analysis in 12.3.1, and added an eligibility criterion that merchants confirm their site is not susceptible to attacks from scripts that could affect their e-commerce systems.\nThe new SAQ A was set to take effect on 31 March 2025, when the October 2024 version was retired. The Council says the change does not remove or diminish the underlying PCI DSS requirements, and that validation requirements are set by compliance enforcing entities such as brands and acquirers.\nIn an August 2024 Council blog Q&A, which notes that 51 of the 64 new requirements were future-dated to 31 March 2025, a QSA company executive says SAQ A e-commerce merchants are now expected to have an Approved Scanning Vendor scan at least once every three months. The June 2024 v4.0.1 announcement says v4.0.1 adds or deletes no requirements and would be the only active version after v4.0 retired on 31 December 2024.\nApplicability\nUse this for merchants that validate with SAQ A. Validation rules come from each merchant’s acquirer or other compliance enforcing entity, so confirm with them and check the Council’s document library for current versions.\nDSE recommendation\nDSE recommends that SAQ A merchants document why their website is not susceptible to script attacks that could affect the payment flow before signing their next self-assessment. Inventory the scripts on pages that redirect to or embed the payment provider, restrict who can change them, keep quarterly ASV scan reports, and confirm with the acquirer that SAQ A still fits.\nVerification\nEach quarter, confirm a passing ASV scan is on file and the script inventory matches what the payment pages load. Before each annual self-assessment, have the acquirer or a QSA confirm the SAQ type.\nOfficial references\nPCI SSC blog — Important Updates Announced for Merchants Validating to SAQ A (January 30, 2025). PCI SSC blog — Future-Dated Requirements of PCI DSS v4.x (August 20, 2024). PCI SSC blog — Just Published: PCI DSS v4.0.1 (June 11, 2024). Reviewed October 18, 2026.", "content_markdown": "PCI SSC’s January 2025 SAQ A update removed payment-page Requirements 6.4.3 and 11.6.1 and targeted risk analysis 12.3.1, but added an eligibility criterion that the merchant’s site is not susceptible to script attacks. The Council said v4.0.1 would be the only active version after v4.0 retired on 31 December 2024.\n\n## Source facts\n\nThe PCI Security Standards Council’s [January 30, 2025 announcement](https://blog.pcisecuritystandards.org/important-updates-announced-for-merchants-validating-to-self-assessment-questionnaire-a) says SAQ A covers merchants that completely outsource account data functions to PCI DSS validated and compliant third parties and keep only paper reports or receipts with account data. The update removed payment-page Requirements 6.4.3 and 11.6.1 and the related targeted risk analysis in 12.3.1, and added an eligibility criterion that merchants confirm their site is not susceptible to attacks from scripts that could affect their e-commerce systems.\n\nThe new SAQ A was set to take effect on 31 March 2025, when the October 2024 version was retired. The Council says the change does not remove or diminish the underlying PCI DSS requirements, and that validation requirements are set by compliance enforcing entities such as brands and acquirers.\n\nIn an [August 2024 Council blog Q&A](https://blog.pcisecuritystandards.org/now-is-the-time-for-organizations-to-adopt-the-future-dated-requirements-of-pci-dss-v4-x), which notes that 51 of the 64 new requirements were future-dated to 31 March 2025, a QSA company executive says SAQ A e-commerce merchants are now expected to have an Approved Scanning Vendor scan at least once every three months. The [June 2024 v4.0.1 announcement](https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1) says v4.0.1 adds or deletes no requirements and would be the only active version after v4.0 retired on 31 December 2024.\n\n## Applicability\n\nUse this for merchants that validate with SAQ A. Validation rules come from each merchant’s acquirer or other compliance enforcing entity, so confirm with them and check the Council’s document library for current versions.\n\n## DSE recommendation\n\nDSE recommends that SAQ A merchants document why their website is not susceptible to script attacks that could affect the payment flow before signing their next self-assessment. Inventory the scripts on pages that redirect to or embed the payment provider, restrict who can change them, keep quarterly ASV scan reports, and confirm with the acquirer that SAQ A still fits.\n\n## Verification\n\nEach quarter, confirm a passing ASV scan is on file and the script inventory matches what the payment pages load. Before each annual self-assessment, have the acquirer or a QSA confirm the SAQ type.\n\n## Official references\n\n[PCI SSC blog — Important Updates Announced for Merchants Validating to SAQ A (January 30, 2025)](https://blog.pcisecuritystandards.org/important-updates-announced-for-merchants-validating-to-self-assessment-questionnaire-a). [PCI SSC blog — Future-Dated Requirements of PCI DSS v4.x (August 20, 2024)](https://blog.pcisecuritystandards.org/now-is-the-time-for-organizations-to-adopt-the-future-dated-requirements-of-pci-dss-v4-x). [PCI SSC blog — Just Published: PCI DSS v4.0.1 (June 11, 2024)](https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/pci-dss-v4-0-1-saq-a-script-eligibility-asv-scans/", "url": "https://update.dsesecurity.com/updates/pci-dss-v4-0-1-saq-a-script-eligibility-asv-scans/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/pci-dss-v4-0-1-saq-a-script-eligibility-asv-scans/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "SAQ A merchants under PCI DSS v4.0.1: document the script-attack eligibility criterion and quarterly ASV scans", "item": "https://update.dsesecurity.com/updates/pci-dss-v4-0-1-saq-a-script-eligibility-asv-scans/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/pci-dss-v4-0-1-saq-a-script-eligibility-asv-scans/#article", "identifier": "https://update.dsesecurity.com/updates/pci-dss-v4-0-1-saq-a-script-eligibility-asv-scans/", "url": "https://update.dsesecurity.com/updates/pci-dss-v4-0-1-saq-a-script-eligibility-asv-scans/", "headline": "SAQ A merchants under PCI DSS v4.0.1: document the script-attack eligibility criterion and quarterly ASV scans", "description": "PCI SSC’s January 2025 SAQ A update removed payment-page Requirements 6.4.3 and 11.6.1 and targeted risk analysis 12.3.1, but added an eligibility…", "abstract": "PCI SSC’s January 2025 SAQ A update removed payment-page Requirements 6.4.3 and 11.6.1 and targeted risk analysis 12.3.1, but added an eligibility criterion that the merchant’s site is not susceptible to script attacks. The Council said v4.0.1 would be the only active version after v4.0 retired on 31 December 2024.", "articleBody": "PCI SSC’s January 2025 SAQ A update removed payment-page Requirements 6.4.3 and 11.6.1 and targeted risk analysis 12.3.1, but added an eligibility criterion that the merchant’s site is not susceptible to script attacks. The Council said v4.0.1 would be the only active version after v4.0 retired on 31 December 2024.\nSource facts\nThe PCI Security Standards Council’s January 30, 2025 announcement says SAQ A covers merchants that completely outsource account data functions to PCI DSS validated and compliant third parties and keep only paper reports or receipts with account data. The update removed payment-page Requirements 6.4.3 and 11.6.1 and the related targeted risk analysis in 12.3.1, and added an eligibility criterion that merchants confirm their site is not susceptible to attacks from scripts that could affect their e-commerce systems.\nThe new SAQ A was set to take effect on 31 March 2025, when the October 2024 version was retired. The Council says the change does not remove or diminish the underlying PCI DSS requirements, and that validation requirements are set by compliance enforcing entities such as brands and acquirers.\nIn an August 2024 Council blog Q&A, which notes that 51 of the 64 new requirements were future-dated to 31 March 2025, a QSA company executive says SAQ A e-commerce merchants are now expected to have an Approved Scanning Vendor scan at least once every three months. The June 2024 v4.0.1 announcement says v4.0.1 adds or deletes no requirements and would be the only active version after v4.0 retired on 31 December 2024.\nApplicability\nUse this for merchants that validate with SAQ A. Validation rules come from each merchant’s acquirer or other compliance enforcing entity, so confirm with them and check the Council’s document library for current versions.\nDSE recommendation\nDSE recommends that SAQ A merchants document why their website is not susceptible to script attacks that could affect the payment flow before signing their next self-assessment. Inventory the scripts on pages that redirect to or embed the payment provider, restrict who can change them, keep quarterly ASV scan reports, and confirm with the acquirer that SAQ A still fits.\nVerification\nEach quarter, confirm a passing ASV scan is on file and the script inventory matches what the payment pages load. Before each annual self-assessment, have the acquirer or a QSA confirm the SAQ type.\nOfficial references\nPCI SSC blog — Important Updates Announced for Merchants Validating to SAQ A (January 30, 2025). PCI SSC blog — Future-Dated Requirements of PCI DSS v4.x (August 20, 2024). PCI SSC blog — Just Published: PCI DSS v4.0.1 (June 11, 2024). Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:01:10+00:00", "dateModified": "2026-10-18T22:22:08+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/pci-dss-v4-0-1-saq-a-script-eligibility-asv-scans/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/pci-dss-v4-0-1-saq-a-script-eligibility-asv-scans/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "SAQ A merchants under PCI DSS v4.0.1: document the script-attack eligibility criterion and quarterly ASV scans" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Briefing", "Advisory priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 406, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "PCI SSC blog — Important Updates Announced for Merchants Validating to SAQ A (January 30, 2025)", "url": "https://blog.pcisecuritystandards.org/important-updates-announced-for-merchants-validating-to-self-assessment-questionnaire-a" } } ] } }