Complete SAQ B-IP for your IP-connected card terminals with confidence

SAQ B-IP is a PCI DSS Self-Assessment Questionnaire for merchants that accept cards only through standalone, PCI-listed PTS point-of-interaction terminals connected to their payment processor over IP. It includes only the 50 PCI DSS v4.0.1 requirements relevant to that setup, such as network security controls, terminal tamper protection, secure paper record handling and security policies. Merchants complete it with an Attestation of Compliance and submit it as their acquirer directs.

You are eligible for SAQ B-IP if you use only standalone, PCI-listed PTS POI devices connected via IP directly to your processor, those devices are not connected to other systems in your environment, the terminals do not rely on a computer, phone or tablet to connect, and you keep no account data electronically. Any retained card data must be on paper and not received electronically. Service providers, e-commerce channels and merchants using SCRs or SCRPs are not eligible.

The difference is how the terminal connects. SAQ B covers merchants using imprint machines or standalone dial-out terminals over a phone line, while SAQ B-IP covers standalone PTS-approved terminals that connect to the processor over IP. Because an IP connection touches the merchant's network, SAQ B-IP adds requirements on firewalls, routers, wireless, patching, remote access and quarterly ASV vulnerability scans that SAQ B does not include.

Yes. Requirement 11.3.2 in SAQ B-IP requires external vulnerability scans at least once every three months by a PCI SSC Approved Scanning Vendor (ASV), with rescans until passing results are achieved. If you use segmentation to isolate your terminals from other networks, Requirement 11.4.5 also requires penetration testing of those segmentation controls to confirm they are effective.

PCI DSS is enforced contractually, not by law, so consequences come from your acquirer and the card brands. Depending on your agreement, these can include non-compliance charges, higher processing fees, liability for fraud losses and forensic investigation costs after a breach, and in serious cases loss of the ability to accept cards. The exact consequences are set by your acquirer and are not published by the PCI Security Standards Council.

It depends on how ready your environment already is. Completing the questionnaire itself is relatively quick because it covers 50 requirements, but you may first need to segment terminals from other systems, harden routers and wireless networks, write policies, set up a POI device inventory and inspection routine, and pass an ASV scan. Merchants with these controls already in place typically spend far less time than those starting from scratch.

SAQ B-IP and ISO 27001 overlap but are not interchangeable. Both expect security policies, access control, vulnerability management, supplier management and incident response, so evidence for one often supports the other. ISO 27001 is a certifiable management system for your whole organisation, while SAQ B-IP is a narrow, payment-specific self-assessment. Holding ISO 27001 does not replace the SAQ your acquirer requires.

SAQ B-IP is mapped in OneClickComply's control library and is available on request. That means its requirements are linked to the same controls used for frameworks such as ISO 27001, so evidence and policies can be reused. Our audit team can help you confirm eligibility and prepare your answers. OneClickComply does not issue PCI DSS validation; you submit your SAQ and Attestation of Compliance to your acquirer.