If a merchant does not have Internet access what options do they have to complete SAQ forms?
This is a 2-part answer:
Part 1: A merchant does not need Internet access in the retail environment to complete the SAQ or to be PCI compliant. They only need Internet access during the process of completing their SAQ, and an email address to receive certificates and/or remediation response from Panoptic Security. The merchant’s ISO or agent could be a support system for the merchant in the event that no Internet access is available. The ISO can either walk the merchant through the process, using their own Internet access, or provide the merchant with a printed version of the SAQ to do manually and return to Panoptic Security through their ISO. At all times, a merchant can retrieve a complete FAQ to use as a guide through the SAQ process through the Panoptic website, or by having their ISO or agent provide them with a printed version along with the printed SAQ.
Part 2: If a merchant does not have on-site Internet access in their retail environment, their PCI compliance and security risk potential may be reduced or simplified as a result. This is not the rule, but the norm.