Guide
SAQ P2PE: the shortest path, if you truly qualify
SAQ P2PE is one of the shortest PCI DSS questionnaires. However, it applies only to merchants using hardware terminals from a validated point-to-point encryption solution.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
Who qualifies for SAQ P2PE
Eligibility is strict. So check every condition before you rely on the shorter form.
- Card data is accepted only through terminals in a validated P2PE solution
- The solution appears on the official PCI SSC list
- You do not store, process or transmit card data electronically elsewhere
- Terminals are managed as the solution instructions require
Why the validated listing matters for SAQ P2PE
Many terminals encrypt data. However, only a solution validated by PCI SSC qualifies for this form. Therefore a vendor claim of encryption is not enough.
SAQ P2PE eligibility check
Tick only what is fully true. One untick can change your form.
Your result appears here as you tick, so you can see what is still open.
What SAQ P2PE covers
The form focuses on what you still control. For example, terminal inspection, policies and the P2PE Instruction Manual from your provider.
| Area | Typical focus |
|---|---|
| Devices | Inventory and inspection for tampering. |
| Procedures | Following the solution instruction manual. |
| Policy | Security awareness and incident response. |
What disqualifies a merchant
Mixed acceptance channels are the usual reason. For example, taking card numbers by phone into a computer moves you to another SAQ. Also, a non-validated terminal anywhere breaks eligibility.
Where we help
We confirm eligibility and complete the form with you. SAQ completion support runs $500 to $20,000. We are not a QSA, so you sign the attestation. Solutions are listed in the PCI SSC document library.
One more point is worth checking. Solutions can lose their listing, or a version can expire. Therefore confirm the listing each year before you file SAQ P2PE again. Also keep the provider's instruction manual where staff can find it, because inspection steps come from it. As a result, the evidence for the form stays current.
SAQ P2PE questions
Is SAQ P2PE shorter than SAQ B?
Usually yes, because a validated solution removes many controls from your scope.
Can we use SAQ P2PE with an online store?
Not for the online channel. That channel needs its own SAQ.
How do we confirm a solution for SAQ P2PE?
Check the official PCI SSC listing, not only the vendor's website.
Do we still need terminal inspections?
Yes. Inspection for tampering is part of the form.
Related guides
Confirm whether SAQ P2PE fits you
Describe how you take payments. We reply with a written estimate, usually inside one business day.
Get my written estimate