PCI DSS SAQ P2PE Compliance Guide
The lightest PCI DSS self-assessment for card-present merchants using a validated Point-to-Point Encryption (P2PE) solution that encrypts cardholder data at the terminal.
Understand SAQ P2PE eligibility, requirements, common pitfalls, and how GRCTrack streamlines your compliance journey.
What Is SAQ P2PE?
SAQ P2PE is a PCI DSS Self-Assessment Questionnaire designed for merchants who process card-present transactions exclusively through a PCI-validated Point-to-Point Encryption (P2PE) solution. With approximately 33 requirements, it is the SAQ with the fewest controls of any SAQ type because the P2PE solution handles the vast majority of cardholder data security.
Point-to-Point Encryption works by encrypting cardholder data at the point of interaction (POI) device — the payment terminal — using tamper-resistant hardware and strong cryptographic keys. The encrypted data travels through the merchant environment without ever being decrypted, and decryption only occurs within the P2PE solution provider's secure decryption environment. This means the merchant never has access to cleartext cardholder data.
Because the merchant environment is effectively removed from the cardholder data flow, most PCI DSS requirements become non-applicable. The remaining requirements in SAQ P2PE focus on maintaining the validated P2PE environment as documented in the P2PE Instruction Manual (PIM), physically securing POI devices, and maintaining organizational security policies under Requirements 9 and 12.
Who Qualifies for SAQ P2PE?
Key SAQ P2PE Requirements
PCI-Listed P2PE Solution
Use only a Point-to-Point Encryption solution that is currently listed on the PCI SSC List of Validated P2PE Solutions. Non-listed or expired solutions disqualify merchants from SAQ P2PE eligibility.
P2PE Instruction Manual (PIM)
Comply with all merchant responsibilities documented in the P2PE Instruction Manual provided by your solution vendor. The PIM defines device installation, inspection, and incident response procedures specific to your environment.
Req 9: Physical Security of POI Devices
Maintain physical security of all payment terminals. Implement tamper-detection procedures including regular device inspections, serial number verification, and training staff to identify signs of terminal tampering or substitution.
Req 9: Device Inventory & Controls
Maintain an up-to-date inventory of all POI devices including make, model, location, and serial number. Restrict physical access to terminals and ensure devices are not moved or connected to unauthorized systems.
Req 12: Security Policies
Maintain an information security policy that addresses the P2PE environment. Define roles and responsibilities, document acceptable use of payment terminals, and establish an incident response plan for suspected device tampering.
Req 12: Security Awareness
Implement a security awareness program that trains personnel on P2PE device handling, tamper recognition, and incident reporting procedures. Staff interacting with POI devices must understand their security responsibilities.
Common SAQ P2PE Mistakes
Using a Non-PCI-Listed P2PE Solution
Some merchants assume that any terminal marketed as "P2PE" or "encrypted" qualifies for SAQ P2PE. Only solutions appearing on the PCI SSC List of Validated P2PE Solutions are eligible. Using a non-listed solution — even one that claims to use point-to-point encryption — requires the merchant to complete a different SAQ type such as SAQ B-IP, SAQ C, or SAQ D depending on the payment architecture.
Not Following the P2PE Instruction Manual
The P2PE Instruction Manual (PIM) is not optional guidance — it is a mandatory compliance document. Merchants must follow every instruction in the PIM, including device installation procedures, network configuration requirements, and periodic inspection schedules. Deviating from the PIM can invalidate the P2PE validation for the merchant's environment and require a more comprehensive SAQ assessment.
Modifying or Tampering with POI Devices
Connecting unauthorized peripherals, installing non-approved software, or physically modifying POI devices can break the P2PE validation chain. Even well-intentioned changes such as adding a custom case, relocating a device without following PIM procedures, or connecting the terminal to a non-approved network can compromise the encrypted environment and disqualify the merchant from SAQ P2PE.
Not Maintaining Physical Security of Terminals
SAQ P2PE requires rigorous physical security of POI devices under Requirement 9. Merchants must regularly inspect terminals for evidence of tampering or substitution, maintain a device inventory with serial numbers and locations, and train staff to recognize suspicious activity. Failing to perform routine inspections or leaving terminals unattended in publicly accessible areas is a common compliance gap.
How GRCTrack Helps with SAQ P2PE Compliance
SAQ P2PE Compliance — Frequently Asked Questions
Related PCI DSS Resources
Ready to Complete Your SAQ P2PE Assessment?
GRCTrack guides you through every SAQ P2PE requirement with step-by-step compliance workflows.