PCI DSS Validation Explained: AOC, ROC and the SAQ Types

Being compliant with PCI DSS and being able to prove it are different things. The proof is a set of validation documents, and knowing which applies to whom is the practical part of the standard.

For the requirements themselves, see the PCI DSS article linked at the end.

The three documents

SAQ — Self-Assessment Questionnaire. A structured checklist the merchant completes themselves, with a yes/no answer for each applicable requirement. Used by merchants who are not required to undergo an external audit.

ROC — Report on Compliance. A detailed report produced by a Qualified Security Assessor after an on-site assessment, documenting how each requirement was tested and what evidence was examined. Required for the largest merchants and many service providers.

AOC — Attestation of Compliance. The signed declaration that the assessment was completed and states the outcome. It accompanies either an SAQ or a ROC.

The relationship matters and is the most likely exam point: the SAQ or ROC contains the detail; the AOC is the signed summary. The AOC is what you send to an acquiring bank or a customer, because it confirms compliance without disclosing the full security detail of your environment.

That is also why you should be cautious about handing out a full ROC — it describes your controls comprehensively, which is useful to an attacker.

Who needs which

Driven by merchant level, which is driven by annual transaction volume.

Level	Rough volume	Validation
1	Over 6 million	ROC by a QSA (or internal auditor with officer sign-off), plus AOC
2	1–6 million	SAQ plus AOC; some brands require a ROC
3	20,000–1 million e-commerce	SAQ plus AOC
4	Under 20,000 e-commerce	SAQ plus AOC, set by the acquirer

Service providers have their own thresholds, and any service provider handling significant transaction volume will generally need a ROC.

The SAQ types

Not one questionnaire but several, and choosing the right one is the decision that matters — each covers a different subset of requirements according to how you handle card data.

SAQ A — card-not-present merchants who have fully outsourced all cardholder data functions, with no electronic storage, processing or transmission on their systems. The shortest by far.

SAQ A-EP — e-commerce merchants who outsource payment processing but whose website affects the security of the payment transaction. The distinction from SAQ A catches many merchants out: if your page loads the payment form, you are likely A-EP, which is substantially more work.

SAQ B — imprint machines or standalone dial-out terminals, no electronic storage.

SAQ B-IP — standalone IP-connected terminals.

SAQ C — payment application systems connected to the internet, no electronic storage.

SAQ C-VT — web-based virtual terminal on an isolated computer.

SAQ P2PE — merchants using a validated point-to-point encryption solution. The shortest of the terminal-based questionnaires, which is a strong argument for P2PE.

SAQ D — everyone else, including all service providers. Covers essentially every requirement.

The practical lesson: architecture determines which SAQ applies, and therefore how much work compliance is. Outsourcing capture through a hosted payment page or using P2PE and tokenisation can move a merchant from SAQ D to SAQ A, which is a dramatic reduction in scope and effort.

The supporting evidence

Validation is not only the questionnaire. Quarterly external vulnerability scans must be performed by an Approved Scanning Vendor and must pass. Internal scans and penetration testing are required annually and after significant change. Where applicable, evidence of segmentation testing confirms that out-of-scope systems really are out of scope.

Missing ASV scans are a common reason an otherwise compliant merchant cannot complete validation.

Compliance is a point in time

An AOC states that the environment met the requirements when assessed. It says nothing about the following Tuesday.

The standard expects continuous compliance, and the assessment is an annual check of it. Organisations that treat it as an annual project drift out of compliance within weeks and are frequently found non-compliant after a breach despite holding a current AOC — which removes the protection the AOC appeared to provide.

What to remember

The SAQ or ROC holds the detail; the AOC is the signed declaration that accompanies it and is what you share. Level 1 merchants need a ROC from a QSA; smaller merchants self-assess. There are multiple SAQ types, and which applies depends on how you handle card data — architecture choices such as hosted payment pages, P2PE and tokenisation can move you to a much shorter one. ASV scans are required alongside. Compliance is continuous, not annual.

Related reading: PCI DSS · Tokenization · Attestation