Compliance Assessment ToolSAQ B-IP: who needs it?
SAQ B-IP is for businesses using a standalone card terminal that connects to the processor over the internet — with the terminal kept separate from your other computers.
This is probably you if…
- You take card payments on a standalone, PCI-approved terminal that connects over the internet (Ethernet, Wi-Fi or cellular).
- The terminal talks only to your payment processor and does not depend on a computer, phone or tablet to connect.
- The terminal is kept separate from your other systems, and you never store card numbers electronically.
Typical setups
- A countertop terminal from your processor plugged into its own network connection.
- A wireless terminal that connects directly to the processor over cellular.
It's probably not SAQ B-IP if…
- The terminal is part of a validated P2PE solution — SAQ P2PE is usually shorter; ask your provider.
- The terminal connects through a register, tablet or computer — that is usually SAQ C.
- It is a small reader paired to a phone or tablet app — look at SAQ SPoC.
Not sure it's SAQ B-IP?
Describe how you take payments in your own words and we'll check it against every SAQ's conditions — free. If it is SAQ B-IP, we walk you through it in plain English and produce your signed SAQ and Attestation of Compliance.
Check my SAQ — free →The official eligibility criteria
To use SAQ B-IP, the PCI Security Standards Council requires all of the following:
- The merchant uses only standalone, PCI-listed approved PTS POI devices (excludes SCRs and SCRPs) connected via IP to merchant's payment processor to take customers' payment card information;
- The standalone, IP-connected POI devices are validated to the PTS POI program as listed on the PCI SSC website (excludes SCRs and SCRPs);
- The standalone, IP-connected PTS POI devices are not connected to any other systems within the merchant environment (this can be achieved via network segmentation to isolate PTS POI devices from other systems);
- The only transmission of account data is from the approved PTS POI devices to the payment processor;
- The PTS POI device does not rely on any other device (e.g., computer, mobile phone, tablet, etc.) to connect to the payment processor;
- The merchant does not store account data in electronic format; and
- Any account data the merchant might retain is on paper (for example, printed reports or receipts), and these documents are not received electronically.
Questions people ask
What does "kept separate from other systems" mean for a small shop?
The terminal should not be on the same open network as the computers your staff use for email and browsing. A separate network used only by the terminal, or a cellular connection, are common ways to do it. A guest Wi-Fi that customers also use does not count.
How do I know my terminal is PCI-approved?
Terminals supplied by mainstream processors normally are. You can confirm the model on the PCI SSC list of approved PIN Transaction Security (PTS) devices, or ask your provider.
Other SAQ types
SAQ A · SAQ A-EP · SAQ B · SAQ C · SAQ C-VT · SAQ P2PE · SAQ SPoC · SAQ D
This guide helps you identify the right self-assessment questionnaire. Your acquiring bank or payment processor decides which SAQ you must submit — confirm with them if you are unsure. Compliance Assessment Tool helps you complete a PCI DSS self-assessment; we are not a Qualified Security Assessor (QSA) and do not certify compliance. Eligibility criteria quoted from PCI DSS v4.0.1 SAQ B-IP documentation published by the PCI Security Standards Council.