PCI DSS Compliance: Pass the SAQ Without Breaking the Renewal.

For card-present merchants without electronic cardholder data storage: SAQ B-IP (network-connected POS) or SAQ C-VT (virtual terminal) typically apply. For e-commerce with redirect-to-processor: SAQ A. For e-commerce with direct payment page hosting: SAQ A-EP. For full storage/processing/transmission: SAQ D. The acquirer’s eligibility worksheet drives the selection — not the merchant’s preference. Triton scopes the correct SAQ as part of the engagement intake.

Yes. The PSP integration reduces your SAQ scope but does not eliminate it. SAQ B-IP or P2PE (depending on whether the integration is Point-to-Point Encrypted) still applies. Your network segmentation, MFA on administrative access, and incident response plan remain in scope regardless of the POS vendor. The PSP handles the cardholder-data-storage requirements only when the integration is genuinely outside your environment.

SAQ A applies when the entire payment page is hosted by the third-party processor — the customer never lands on your domain during payment entry. SAQ A-EP applies when you host the payment page but redirect or iframe the actual card-entry to the processor. SAQ A-EP scope is significantly larger because your servers are still in the path. PCI DSS 4.0.1 introduced new requirements specifically targeting SAQ A-EP merchants — penetration testing, segmentation, and integrity monitoring on the payment page server.

Total compliance investment for a five-location small operator typically runs $18,000 to $45,000 over the first year. The split: Sophos Firewall + Endpoint deployment ($6-15K), MFA + Defender configuration ($3-8K), penetration test ($4-8K), segmentation documentation and SAQ authoring ($3-8K), continuous monitoring tooling ($2-6K annual). The acquirer assessment fee varies by acquirer — most include it in monthly processing.

For Level 3-4 merchants on the SAQ path, no QSA is required — Triton delivers the evidence file the acquirer needs for self-attestation. For Level 1-2 merchants requiring a QSA, we partner with a named QSA firm and provide the technical evidence the QSA validates. We do not function as a QSA — that creates an independence conflict — but the evidence file we deliver is the bulk of the work the QSA assessment runs against.

That is a SAQ scope problem on its face. The P2PE attestation is what reduces your SAQ B-IP to P2PE (smallest scope). Without it, you stay on the larger-scope SAQ. The fix is either pressuring the POS vendor, switching to a P2PE-attested vendor, or accepting the larger SAQ scope. We help operators evaluate the cost-of-switching against the cost-of-larger-SAQ before recommending a path.

Cyber insurance carriers have aligned their underwriting questionnaires to PCI DSS 4.0.1 — the same MFA, segmentation, and penetration-testing evidence satisfies both. The reverse is also true: a cyber-insurance non-renewal can trigger acquirer scrutiny, since most carriers communicate underwriting failures to acquirers under shared-risk arrangements. Our PCI engagement and our cyber-insurance-readiness engagement share most of the evidence file by design.

No. Dark web monitoring is a notification service, not a PCI DSS control. The 4.0.1 standard does not reference it. The correct investment is the proactive hardening 4.0.1 actually requires — segmentation, MFA, file integrity monitoring, audit logging, and quarterly external scanning by an Approved Scanning Vendor. We do not bundle dark web monitoring and it does not appear on any PCI DSS evidence list.