Guide
PCI SAQ B IP for internet-connected payment terminals
PCI SAQ B IP covers merchants whose standalone terminals connect to the processor over IP. So it sits between SAQ B and the larger forms, with extra network controls.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
Who fits PCI SAQ B IP
The form suits a specific setup. However, small differences can move you to another form.
- Standalone terminals approved under the PCI PTS programme
- Terminals connect to the processor over IP
- No electronic storage of card data
- Terminals are not connected to other systems in your environment
How PCI SAQ B IP differs from SAQ B
SAQ B covers dial-out terminals. In contrast, B-IP adds network requirements, because an IP connection creates more exposure.
| Topic | SAQ B | SAQ B-IP |
|---|---|---|
| Connection | Phone line | IP network |
| Network controls | Minimal | Firewall and segmentation expected |
| Scanning | Not usually | May apply, depending on setup |
PCI SAQ B IP readiness check
Tick what is true at every location.
Your result appears here as you tick, so you can see what is still open.
Network controls in PCI SAQ B IP
The key idea is isolation. For example, terminals sit on a network segment that ordinary office devices cannot reach. Also, default passwords on routers must change.
Common mistakes
Terminals often share Wi-Fi with guests or office laptops. Therefore the isolation the form assumes does not exist. Also, merchants forget that the terminal must appear on the approved device list.
Where we help
We review the network and complete the form with you. SAQ completion support runs $500 to $20,000. We are not a QSA, so you sign your own attestation. Forms are in the PCI SSC document library.
Also review each location separately. For example, one shop may have a clean terminal network, while another shares the guest router. So the form is only as accurate as the weakest site. In addition, keep a simple diagram per location, because it answers most assessor questions quickly.
PCI SAQ B IP questions
Do we need ASV scans for PCI SAQ B IP?
Possibly, if the setup exposes in-scope systems to the internet. Your acquirer and the form instructions decide.
Can tablets running payment apps use PCI SAQ B IP?
No. The form is for standalone PTS terminals, not general-purpose devices.
What if terminals share the office network under PCI SAQ B IP?
Then the eligibility conditions fail, so segment them first.
Who signs the attestation?
An officer of your business signs it.
Related guides
Check your fit for PCI SAQ B IP
Send five answers about your locations and terminals. We reply with a written estimate, usually inside one business day.
Get my written estimate