If a merchant has multiple processing environments, should the merchant complete multiple SAQ forms to validate their PCI DSS compliance?
If a merchant has multiple processing environments, whereby one environment qualifies it to complete SAQ form A and another qualifies it to complete SAQ form B, then it is advisable that the merchant default to the more stringent of the two SAQ forms (in this case, SAQ form B). However, we recommend that the merchant consult with its acquirer to determine which SAQ form would be appropriate to validate the merchant?s PCI DSS compliance.