PCI DSS SAQ B-IP Compliance Guide
The PCI DSS self-assessment for merchants using standalone, PTS-approved payment terminals connected to the processor over an IP-based network.
Understand SAQ B-IP eligibility, requirements, common pitfalls, and how GRCTrack streamlines your compliance journey.
What Is SAQ B-IP?
SAQ B-IP is a PCI DSS Self-Assessment Questionnaire designed for merchants who process card payments using standalone, PTS-approved payment terminals that connect to the payment processor over an IP-based network. These terminals must not store cardholder data electronically, and the merchant must not have any e-commerce payment channels.
SAQ B-IP applies to brick-and-mortar merchants whose payment terminals use an internet, Ethernet, or Wi-Fi connection to communicate with the payment processor, rather than dialing out over a traditional phone line. The terminal must be a standalone device listed on the PCI SSC's approved PTS devices list and must be the only device in the merchant environment that processes, transmits, or stores cardholder data.
With approximately 82 requirements, SAQ B-IP is roughly twice the size of SAQ B because the IP network connection introduces security risks that require additional controls. Beyond the physical security and access control requirements shared with SAQ B, SAQ B-IP adds requirements for network security controls (firewalls), secure transmission of cardholder data, vulnerability management (anti-malware and patching), and regular security testing including quarterly ASV scans. This makes SAQ B-IP a substantially more rigorous assessment than SAQ B.
Who Qualifies for SAQ B-IP?
Key SAQ B-IP Requirements
Req 1: Network Security Controls
Install and maintain network security controls (firewalls) to protect the cardholder data environment. Segment the terminal network from general business traffic, restrict inbound and outbound connections, and maintain documented firewall rules.
Req 2: Secure Configurations
Apply secure configurations to all system components including payment terminals, routers, firewalls, and network switches. Change all vendor-supplied default passwords and settings, and disable unnecessary services and protocols.
Req 4: Secure Transmissions
Protect cardholder data with strong cryptography during transmission over open, public networks. Ensure the terminal uses encrypted connections (TLS 1.2 or higher) when communicating with the payment processor over the IP network.
Req 5-6: Vulnerability Management
Protect all systems against malware and regularly update anti-malware software. Develop and maintain secure systems by applying security patches promptly. Keep terminal firmware up to date with the latest security patches from the manufacturer.
Req 9: Physical Security
Restrict physical access to cardholder data and payment terminals. Maintain terminal inventories, regularly inspect devices for tampering or unauthorized substitution, and train staff to detect suspicious modifications to terminals.
Req 11: Security Testing
Regularly test security systems and processes. Perform quarterly external vulnerability scans by an Approved Scanning Vendor (ASV), run internal vulnerability scans, and detect unauthorized wireless access points in the cardholder data environment.
Common SAQ B-IP Mistakes
Failing to Segment the Terminal Network
One of the most critical mistakes is connecting payment terminals to the same network as general business systems (computers, printers, Wi-Fi for customers). PCI DSS Requirement 1 mandates that the cardholder data environment be isolated from untrusted networks. Without proper network segmentation using firewalls or VLANs, the scope of your PCI assessment expands to include every system on the shared network, potentially requiring SAQ C or SAQ D instead.
Not Patching Terminal Firmware
Payment terminals run embedded software that requires regular security updates from the manufacturer. Many merchants treat terminals as set-and-forget devices, but PCI DSS Requirements 5 and 6 require that all system components — including payment terminals — are kept up to date with security patches. Outdated firmware can contain vulnerabilities that attackers exploit to intercept cardholder data. Establish a process to check for and apply terminal firmware updates at least quarterly.
Sharing Terminal Network with General Business Traffic
Allowing general internet traffic, email, web browsing, or other business applications to traverse the same network as payment terminals dramatically increases security risk and PCI DSS scope. The terminal network should only carry payment transaction traffic. Use a dedicated VLAN or physically separate network for payment terminals, with firewall rules that restrict traffic to only what is necessary for payment processing.
Skipping Quarterly ASV Scans
Unlike SAQ B, SAQ B-IP requires quarterly external vulnerability scans performed by a PCI SSC Approved Scanning Vendor (ASV). Many merchants transitioning from SAQ B to SAQ B-IP are unaware of this requirement. ASV scans must cover all externally accessible IP addresses associated with the cardholder data environment and must produce a passing result. Failing to complete these scans is a compliance gap that can result in non-compliance findings.
How GRCTrack Helps with SAQ B-IP Compliance
SAQ B-IP Compliance — Frequently Asked Questions
Related PCI DSS Resources
Ready to Complete Your SAQ B-IP Assessment?
GRCTrack guides you through every SAQ B-IP requirement with step-by-step compliance workflows.