PCI SAQ A cost 2026: the smallest SAQ, and what decides your bill

The control count is the cost signal

Every count below is published, in the SAQ document itself in the PCI SSC library, under v4.0.1. Counts are approximate and shift slightly with how sub-requirements are counted, so confirm yours in the document. This is the comparison that matters, because the number of things you have to evidence is the closest thing PCI has to a unit of work, and it is what any firm quoting you will price against.

Source: the SAQ A, SAQ A-EP and SAQ D-Merchant documents, PCI SSC document library, v4.0.1. Under the retired v3.2.1 the SAQ D-Merchant count was 329; v4.0 consolidated many sub-requirements, so the v4.0.1 counts are lower.

The SAQ A qualification decision

SAQ A applies to card-not-present merchants who have fully outsourced all cardholder data functions to PCI DSS validated third parties, where the merchant's own systems neither store, process nor transmit cardholder data. The formal criteria are printed at the front of the SAQ A document, and that is the text your acquirer will hold you to. Read it before you complete anything, because it is the cheapest scoping work available to you and it is free.

The thing most often got wrong is treating the gateway's brand name as the answer. It is not. What decides your SAQ is where the card data collection actually happens against the criteria in the document, read alongside your processor's own published position on the specific integration you have deployed. Major processors publish per-integration SAQ guidance in their developer documentation. If your integration has been customised, or you have added your own fields around it, that is the part to examine, and it is worth getting your processor's answer in writing for your exact setup rather than reasoning by analogy from someone else's.

Stripe's published position is a useful worked example, because it is unusually explicit. Stripe states that SAQ A applies to merchants using Checkout, Payment Links, or Stripe.js and Elements, on the basis that those products "host all card data collection inputs within an iframe served from Stripe's domain (not yours), so your customers' card information never touches your servers". Stripe also states it "is certified annually by an independent PCI Qualified Security Assessor (QSA) as a PCI Level 1 Service Provider". Both quotes are from docs.stripe.com/security/guide and stripe.com/guides/pci-compliance, checked July 2026. Where a processor publishes a position that specific, it is worth more than any third party's summary of it.

What actually decides your quote

Fix these six answers, put them in one written brief, and give the identical brief to two or three firms. Different assumed scopes are why quotes for the same business can differ by a multiple, and handing everyone the same brief is the only reliable way to find out what yours costs. Ask each what is included, and specifically whether scanning and any remediation help are inside the fee or billed on top.

The one published price in this corner of the market

SecurityMetrics publishes a list price of $399 per year for the product it calls "PCI for small businesses" (securitymetrics.com/pci-small-business-pricing, checked July 2026). It is worth knowing about precisely because it is real and published, which almost nothing else here is. Its published feature list at that price: an External Vulnerability Scan for one IP, an online SAQ, a compliance reporting portal, compliance reporting to your merchant processor, PANscan card-discovery software for one machine, and one seat of security awareness training.

Read the caveats before you treat it as a benchmark, because it is not one. It is a bundle for a single IP, not an SAQ completion rate and not a general market rate. SecurityMetrics' own page carries an asterisk saying "Price discounts available depending on merchant processor", and its general pricing page says "SMB pricing varies based on packages from your acquiring bank". So it is a real anchor for the smallest merchant, it may not be the price you are offered even by SecurityMetrics, and it is not a quote for anyone larger. It is one vendor's list price for one product, which is exactly as much as it should be taken for.

What goes wrong with SAQ A

The most common failure is misclassification: attesting to SAQ A when the integration does not meet the eligibility criteria. It tends to surface at the worst possible moment, during an acquirer compliance review or a post-incident investigation, when the merchant is dealing with both the underlying problem and the fact that its attestation was inaccurate. Acquirers have grown more willing to challenge SAQ A attestations during routine review, and the defence is a written record: your data flow, your processor's confirmation of your integration mode, and your script inventory.

The second is forgetting the checkout page's third-party scripts. Under v4.0.1 the SAQ A eligibility criteria ask you to confirm your site is not susceptible to script attacks, and a checkout page that loads marketing tags, analytics and chat widgets makes that confirmation harder to stand behind. Keeping checkout pages minimal is a compliance control, not just a performance one.

The third is paying twice. A PCI programme fee on your monthly processing statement often already bundles a compliance portal and an SAQ tool, and it is charged whether or not you use them. Before buying SAQ support, read the fee schedule on your last statement rather than the summary total, and find out what you are already paying for. If what you see is a non-compliance fee, completing the SAQ through the portal your processor names is what removes it.