PCI DSS v4.0.1 Self-Assessment Questionnaire (SAQ B)

Why does it matter?

SAQ B is the shortest questionnaire a merchant with a card-present or mail and telephone order channel can use, because a dial-out terminal that touches no other system and no network leaves most of PCI DSS out of scope. The merchant still has to confirm eligibility in writing, test every listed requirement, and sign an attestation that an acquirer or payment brand can act on. Getting the eligibility decision wrong matters more than any single control: the Council's bulletin tells merchants to confirm they meet all the criteria before starting, and to check with the entity that will receive the SAQ.

Key benefits include:

• Four requirements instead of twelve

Section 2 contains Requirements 3, 7, 9 and 12 of PCI DSS; network, cryptography, anti-malware, software, authentication, logging and testing requirements do not appear because the terminal is not connected to the merchant's systems or the Internet.

• A paper-only data footprint

The criteria require that any account data the merchant retains is on paper, such as printed receipts or reports, and that nothing is received electronically; Requirement 3 therefore applies only to merchants that keep such paper records.

• A written eligibility test

Part 2h of the AOC repeats the five criteria as a certification the merchant signs, so the choice of SAQ B is itself documented and reviewable.

• One response per requirement

Each requirement takes exactly one response, and any Not Applicable answer needs an explanation in the appendix provided for it, which keeps the record complete for the acquirer.

• A direct route to the attestation

Parts 3 and 4 of the AOC are inside the same document, so the compliance status, the signatures and any action plan follow straight from the questionnaire responses.

How does it work?

The PCI DSS Self-Assessment Completion Steps list five actions: confirm from the eligibility criteria and the Council's Self-Assessment Questionnaire Instructions and Guidelines that SAQ B is the right questionnaire; confirm the environment is properly scoped; assess it against the PCI DSS requirements; complete Sections 1, 2 and 3; and submit the SAQ and AOC, with any other documentation the recipient asks for, to the organization that manages the compliance program, such as a payment brand or acquirer.

The Expected Testing column tells the merchant how to verify each requirement using three methods: Examine (documents, screenshots, configurations, logs), Observe (people performing a task, physical controls, system behavior) and Interview (conversations with personnel). The merchant then picks one response per requirement from the options the SAQ defines, which include In Place, In Place with a Compensating Controls Worksheet (completed in Appendix B), Not Applicable and Not in Place. Not Tested is not an option in SAQ B because every requirement in it must be tested.

Two special cases are spelled out. Under Guidance for Not Applicable Requirements, the media controls in Requirements 9.4.1 to 9.4.6 apply only if the merchant stores paper media with cardholder data, and Requirement 3 carries a note that it applies only to merchants with paper records containing account data. Under Legal Exception, a requirement that cannot be met because a local or regional law forbids it is marked Not in Place and declared in Part 3; contractual obligations and legal advice do not count. The customized approach cannot be documented in any SAQ.

Key Elements

• Merchant Eligibility Criteria

Only an imprint machine and/or standalone dial-out terminals connected to the processor by phone line; terminals not connected to any other system in the merchant environment; terminals not connected to the Internet; no electronic storage of account data; any retained account data on paper and not received electronically.

• Requirement 3: Protect Stored Account Data

3.1.1 policies and procedures for Requirement 3; 3.3.1 sensitive authentication data (full track, card verification code, PIN) is not retained after authorization; 3.4.1 PAN is masked when displayed so that only the BIN and last four digits are visible to those without a business need.

• Requirement 7: Restrict Access by Business Need to Know

7.2.2 access, including privileged access, is assigned by job classification and function and limited to the least privileges needed.

• Requirement 9: Restrict Physical Access to Cardholder Data

9.4.1 to 9.4.6 physical security, classification, approved and tracked movement, and destruction of media with cardholder data; 9.5.1 protection of point-of-interaction devices against tampering and substitution, with 9.5.1.1 an up-to-date list of devices, 9.5.1.2 periodic inspection of device surfaces and 9.5.1.3 training for personnel in POI environments.

• Requirement 12: Organizational Policies and Programs

12.1.1 to 12.1.3 an overall information security policy, reviewed and with defined responsibilities; 12.6.1 a formal security awareness program; 12.8.1 to 12.8.5 a list of third-party service providers, written agreements, due diligence before engagement, monitoring of their PCI DSS compliance status and a record of which requirements each one manages; 12.10.1 an incident response plan ready to be activated.

• Section 1: AOC Parts 1 and 2

Part 1 contact and assessor details; Part 2a payment channels (MOTO, e-commerce, card-present); 2b role with payment cards; 2c description of the environment and whether segmentation is used; 2d in-scope facilities; 2e PCI SSC validated products and solutions; 2f third-party service providers; 2g summary of responses for Requirements 3, 7, 9 and 12; 2h eligibility to complete SAQ B.

• Section 3: AOC Parts 3 and 4

Part 3 the compliance status (Compliant, Non-Compliant with a target date, or Compliant but with Legal exception), Part 3a the merchant acknowledgement, 3b the executive officer's signature, 3c and 3d the role of any QSA or ISA who assisted; Part 4 the action plan for Requirements 3, 7, 9 and 12, completed only when the recipient asks for it after a Non-Compliant result.

• Appendices

Appendix A notes that the additional requirements for multi-tenant service providers (A1), SSL and early TLS (A2) and designated entities (A3) do not apply to SAQ B merchants; Appendix B is the Compensating Controls Worksheet; further appendices hold the explanations required for each Not Applicable response and the other reporting responses.

What does it cover?

SAQ B applies to merchants that process account data only through imprint machines or standalone dial-out terminals, whether card-present or mail and telephone order, and that store no account data on any computer system (Merchant Eligibility Criteria). The questionnaire covers the terminals, the paper records that may result, the people who handle them and the third parties involved; it excludes e-commerce channels and service providers. A merchant with another payment channel, such as an online store, must validate that channel separately, and Part 2a asks it to say which channels are left out of the assessment and why.

What are its objectives?

The questionnaire is built so that a merchant with this channel can show, in its own words and with its own evidence, that the PCI DSS requirements that apply to it are met:

To confirm, through the five criteria and the Part 2h certification, that the dial-out terminal channel is isolated from other systems and the Internet and that no account data is stored electronically.

To test Requirements 3, 7, 9 and 12 with the Examine, Observe and Interview methods described in Expected Testing, and to record a single response for each.

To document every Not Applicable response, every compensating control and, where a law prevents compliance, every legal exception, so the acquirer can review them.

To describe the environment, its facilities, validated products and third-party service providers in Parts 2b to 2f, with Requirement 12.8 applying to every provider listed.

To produce a signed Attestation of Compliance that states the compliance status and, when needed, an action plan with dates.

Framework in Context

SAQ B is one of the questionnaires the PCI Security Standards Council publishes for merchants that can validate PCI DSS without a Report on Compliance; the Council's SAQ Instructions and Guidelines document explains all of them and how to pick one. Its closest relative is SAQ B-IP, for standalone PTS-approved terminals that reach the processor over IP rather than a phone line and therefore carries network, cryptography and scanning requirements that SAQ B does not. All SAQs validate against PCI DSS v4.0.1, the June 2024 revision of the standard whose future-dated requirements became mandatory on 31 March 2025 and whose predecessor, v4.0, retired on 31 December 2024.

Common Framework Mappings

Because SAQ B carries only a subset of PCI DSS, its mappings are the mappings of the parent standard applied to four requirements: policy, access, physical security and third-party controls that also appear in the general security frameworks below.

Mapped frameworks include:

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2