SAQ A merchants under PCI DSS v4.0.1: document the script-attack eligibility criterion and quarterly ASV scans

PCI SSC’s January 2025 SAQ A update removed payment-page Requirements 6.4.3 and 11.6.1 and targeted risk analysis 12.3.1, but added an eligibility criterion that the merchant’s site is not susceptible to script attacks. The Council said v4.0.1 would be the only active version after v4.0 retired on 31 December 2024.

Source facts

The PCI Security Standards Council’s January 30, 2025 announcement says SAQ A covers merchants that completely outsource account data functions to PCI DSS validated and compliant third parties and keep only paper reports or receipts with account data. The update removed payment-page Requirements 6.4.3 and 11.6.1 and the related targeted risk analysis in 12.3.1, and added an eligibility criterion that merchants confirm their site is not susceptible to attacks from scripts that could affect their e-commerce systems.

The new SAQ A was set to take effect on 31 March 2025, when the October 2024 version was retired. The Council says the change does not remove or diminish the underlying PCI DSS requirements, and that validation requirements are set by compliance enforcing entities such as brands and acquirers.

In an August 2024 Council blog Q&A, which notes that 51 of the 64 new requirements were future-dated to 31 March 2025, a QSA company executive says SAQ A e-commerce merchants are now expected to have an Approved Scanning Vendor scan at least once every three months. The June 2024 v4.0.1 announcement says v4.0.1 adds or deletes no requirements and would be the only active version after v4.0 retired on 31 December 2024.

Applicability

Use this for merchants that validate with SAQ A. Validation rules come from each merchant’s acquirer or other compliance enforcing entity, so confirm with them and check the Council’s document library for current versions.

DSE recommendation

DSE recommends that SAQ A merchants document why their website is not susceptible to script attacks that could affect the payment flow before signing their next self-assessment. Inventory the scripts on pages that redirect to or embed the payment provider, restrict who can change them, keep quarterly ASV scan reports, and confirm with the acquirer that SAQ A still fits.

Verification

Each quarter, confirm a passing ASV scan is on file and the script inventory matches what the payment pages load. Before each annual self-assessment, have the acquirer or a QSA confirm the SAQ type.

Official references

PCI SSC blog — Important Updates Announced for Merchants Validating to SAQ A (January 30, 2025). PCI SSC blog — Future-Dated Requirements of PCI DSS v4.x (August 20, 2024). PCI SSC blog — Just Published: PCI DSS v4.0.1 (June 11, 2024). Reviewed October 18, 2026.