Are SAQ A Merchants Exempt From PCI DSS 6.4.3 & 11.6.1?
The 2025 SAQ A update exempted eligible SAQ A merchants from certain requirements, including PCI DSS 6.4.3 & 11.6.1, on the condition that they confirm their site is not susceptible to attacks from scripts that could affect their ecommerce systems. This video covers who actually qualifies for SAQ A, the phrase that decides it (affect the security of the payment transaction), why SAQ A-EP and SAQ D carry both requirements in full, the two ways PCI SSC FAQ 1588 gives to support the condition, and why many SAQ A merchants keep a minimal script inventory anyway.
Full answer: SAQ A and the Script Requirements: Who Is Exempt
Transcript
Partly. A 2025 update exempted eligible SAQ A merchants from 6.4.3 & 11.6.1, on a condition: you confirm your site is not susceptible to attacks from scripts that could affect your ecommerce systems. Script Monitoring is one tag that watches every script on your payment pages, in every session, so you know what runs before you confirm anything. The carve-out is narrower than it sounds. SAQ A is for card-not-present merchants who fully outsource cardholder data functions, keep no electronic card data, and whose site can't affect the security of the payment transaction. That last phrase does the work. A page that hosts a payment iframe runs your own JavaScript alongside it, and that code can overlay the iframe. Whether that counts as affecting security is for your assessor and acquirer. If your site can affect the payment, you're probably SAQ A-EP, and both requirements apply in full. SAQ D gets no carve-out either. The most common error is assuming SAQ A when it's A-EP. Now the condition. Confirming your site is not susceptible is an assertion. Making it without knowing what scripts run on your pages is uncomfortable if it's ever tested. PCI SSC FAQ 1588 gives two ways to support it: apply 6.4.3 & 11.6.1 techniques to your page, or get written confirmation from your provider, naming your product and integration. A generic compliance statement isn't that. And your acquirer can be stricter than the SAQ, and ask for evidence of script controls anyway. If you qualify and can honestly confirm, you're not obliged to implement the two requirements. But an exemption is not an absence of risk. A skimmer on the page hosting your iframe can still capture card data through an overlay. So many SAQ A merchants keep a minimal inventory anyway. Script Monitoring builds it from real sessions, in a weekly PDF evidence pack. Script Monitoring is free for 1,000 page views a month, with 6.4.3 & 11.6.1 included. Pro starts at $99 a month. Start for free at scriptmonitoring.com.