SAQ C is for merchants running a payment application system — POS software, typically — that's connected to the internet, at a single store location, with no electronic storage of account data.
Eligibility criteria — a merchant needs all of these to be true
They have a payment application system and an internet connection on the same device and/or the same LAN.
That payment application isn't connected to any other system in the merchant's environment (network segmentation can achieve this).
The physical location isn't connected to any other premises or locations — any LAN in play is for a single store only.
No account data is stored electronically; anything retained is paper only.
Multi-location or multi-store LANs are a disqualifier — SAQ C is single-store only.
What this looks like in practice
A single-location retailer running a standalone POS or payment application on an isolated LAN with internet access, or a single-store mail/telephone-order merchant with a similar setup.
Requirement scope
12 requirement categories (essentially everything except Requirement 10) — network security, protecting account data, vulnerability management, access control, monitoring and testing networks, and security policy.
ASV scanning
Yes — Requirement 11 applies, so quarterly ASV scans are required.
Not a fit?
Multi-store or multi-location merchants don't qualify — that pushes to SAQ D. If the merchant is just keying orders into a hosted virtual terminal with no local payment application, look at SAQ C-VT instead.