PCI DSS v4.0.1 Self-Assessment Questionnaire (SAQ B-IP) — Cardholder Data Security Controls for Standalone IP-Connected Terminals

Why it Matters

PCI DSS v4.0.1 SAQ B-IP establishes essential security controls to protect cardholder data in organizations using standalone IP-connected payment terminals.

Key benefits include:

• Strengthen cardholder data protection

Reduce the risk of unauthorized access and data exposure by implementing targeted controls for IP-connected payment terminal environments.

• Simplify compliance scope

Focus PCI DSS assessment requirements on systems and processes specific to SAQ B-IP scope, reducing compliance complexity.

• Enhance visibility and oversight

Establish clear accountability for monitoring and managing security controls protecting cardholder data in terminal environments.

• Support compliance obligations

Facilitate adherence to PCI DSS requirements, helping organizations avoid penalties and demonstrate responsible payment data management.

• Improve incident response preparedness

Establish structured processes for identifying and responding to security breaches involving IP-connected payment terminals.

How it Works

PCI DSS v4.0.1 SAQ B-IP is structured as a self-assessment questionnaire for merchants using standalone IP-connected payment terminals that are not connected to other systems or broader networks. The SAQ organizes its requirements into control domains addressing network security, access controls, encryption, and logging practices, tailored to the specific scope of IP-connected terminal environments similar to SAQ B but with additional network security controls.

Organizations implement SAQ B-IP by confirming their terminal environment qualifies, applying the prescribed security controls including network segmentation and encryption, and maintaining documentation for compliance validation. Typical activities include ensuring personnel understand security responsibilities, managing access controls to payment systems, conducting periodic assessments, and maintaining the documentation required to demonstrate ongoing adherence to PCI DSS requirements for IP-connected terminals.

With SmartSuite, organizations can operationalize SAQ B-IP compliance by leveraging control libraries mapped to SAQ B-IP requirements, maintaining risk registers, and managing policy governance for terminal security. The platform supports evidence collection, compliance tracking, and reporting dashboards that provide visibility into control effectiveness and readiness for PCI DSS assessments.

Key Elements

• IP Terminal Network Security

Describes structural requirements for protecting network connections used by standalone IP-connected payment terminals.

• Cardholder Data Encryption Controls

Specifies encryption requirements for protecting cardholder data transmitted through IP-connected terminal environments.

• Physical and Logical Access Controls

Outlines controls for restricting physical and logical access to payment terminals and cardholder data environments.

• Security Monitoring and Logging

Establishes requirements for audit logging and monitoring of activity within IP-connected terminal environments.

• Vulnerability and Patch Management

Defines processes for identifying and remediating security weaknesses in IP-connected terminal systems.

• Incident Response Procedures

Outlines structured processes for detecting, reporting, and responding to security incidents involving payment terminals.

Framework Scope

PCI DSS v4.0.1 SAQ B-IP is used by merchants that process cardholder data through standalone IP-connected payment terminals not connected to other systems or broader network environments. It governs IP terminal security controls and associated compliance practices, and is typically implemented to protect cardholder data, simplify PCI DSS compliance scope, and support assurance programs for terminal-based payment security.

Framework Objectives

PCI DSS v4.0.1 SAQ B-IP defines targeted security requirements to protect cardholder data in IP-connected terminal environments and support PCI DSS compliance.

Protect cardholder data through encryption and access controls for IP-connected terminals

Simplify PCI DSS compliance scope for merchants using qualifying IP terminal environments

Strengthen governance and oversight of terminal security practices and policies

Enhance visibility and monitoring of security controls in payment terminal environments

Support audit readiness through structured documentation and compliance monitoring

Promote operational resilience by securing IP-connected payment terminal environments

Framework in Context

PCI DSS v4.0.1 SAQ B-IP applies PCI DSS requirements to merchants using standalone IP-connected terminals, bridging the scope between SAQ B and broader SAQ types. Organizations use it to fulfill PCI DSS obligations for IP terminal environments, balancing simplified scope with the additional network security controls required for IP connectivity.

Common Framework Mappings

PCI DSS v4.0.1 SAQ B-IP is commonly mapped to broader payment and information security frameworks to demonstrate control coverage and align security practices across payment terminal environments.

Mapped frameworks include:

ISO/IEC 27001

ISO/IEC 27002

NIST Cybersecurity Framework

NIST SP 800-53

PCI DSS v4.0.1

SOC 2