Complete your PCI DSS SAQ B with less paperwork and more confidence

SAQ B is the PCI DSS Self-Assessment Questionnaire for merchants that take card payments only through imprint machines or standalone, dial-out terminals. Published by the PCI Security Standards Council, the v4.0.1 version contains 27 requirements from PCI DSS Requirements 3, 7, 9 and 12. The merchant answers each requirement, signs the Attestation of Compliance and submits both to its acquirer or payment brand as evidence of PCI DSS compliance.

SAQ B is for merchants that use only an imprint machine and/or standalone dial-out terminals connected by a phone line to their processor. The terminals must not be connected to the internet or to any other system, the merchant must not store account data electronically, and any retained data must be on paper. Both card-present and mail or telephone order merchants can qualify, but e-commerce channels and service providers cannot.

SAQ B covers terminals that dial out over a phone line, while SAQ B-IP covers standalone, PCI-approved payment terminals that connect to the processor over an IP network. Because IP-connected terminals face network threats, SAQ B-IP includes extra requirements such as network security controls and vulnerability scanning. If your terminal connects through broadband or Wi-Fi, SAQ B is usually not the right questionnaire, so confirm with your acquirer.

SAQ B for PCI DSS v4.0.1 contains 27 requirements. They cover not storing sensitive authentication data and masking PAN (Requirement 3), assigning access by need to know (Requirement 7), securing and destroying paper media and protecting POI devices from tampering (Requirement 9), and security policy, awareness training, third-party service provider management and incident response (Requirement 12). Media requirements 9.4.1 to 9.4.6 can be marked not applicable if you store no paper media.

PCI DSS is enforced through contracts rather than law, so consequences come from your acquirer and the card brands. Depending on your merchant agreement, failing to validate compliance can lead to non-compliance fees, higher transaction charges or, ultimately, losing the ability to accept card payments. After a breach, a non-compliant merchant may also face card brand assessments and forensic investigation costs. Check your merchant agreement for the specific terms.

Most merchants complete SAQ B and its Attestation of Compliance once a year, but the exact frequency and deadline are set by your acquirer or payment brand, not by the questionnaire itself. You should also review your SAQ type whenever your payment setup changes, for example if you switch from a dial-out terminal to an IP-connected or integrated terminal, because a different SAQ may then apply.

SAQ B and ISO 27001 overlap but are not interchangeable. Both expect an information security policy, staff awareness training, supplier management and incident response, so work done for one supports the other. However, ISO 27001 certification does not replace SAQ B, which your acquirer requires to validate PCI DSS compliance. OneClickComply maps shared controls so evidence collected once counts towards both.

Yes, on request. SAQ B for PCI DSS v4.0.1 is mapped in OneClickComply's control library and can be enabled for your organisation. It then provides policy generation, POI device and training tracking, third-party provider management and continuous monitoring, with in-house auditors available to answer questions. OneClickComply helps you prepare the questionnaire, but your SAQ and Attestation of Compliance are completed and signed by you.