SAQ B-IP walkthrough: standalone IP-connected terminals
By Sam Rivera, Founder, SentinelPanda · June 3, 2026 · 3 min read · PCI DSS
SAQ B-IP sits between SAQ B and SAQ C. The terminal is "smart" (IP-connected) but standalone (not integrated into a POS system).
Who SAQ B-IP is for
SAQ B-IP applies to merchants using standalone, IP-connected, PTS-approved point-of-interaction (POI) terminals to accept card payments. The terminal is "standalone" — not integrated into a cash register, ECR, or any other payment application. The terminal connects to the payment processor over the internet (typically via the merchant's LAN), but the merchant has no access to the terminal's configuration beyond the printed user manual.
Common qualifying patterns: a Lane/3000 or Verifone P400 terminal at a retail counter, connected to the shop's WiFi but not to any local POS; a SumUp/iZettle-style terminal paired to a mobile device only for transaction relay. The terminal is on the PCI Council's list of PTS-approved devices.
The eligibility checklist
- You use only standalone, PTS-approved IP-connected POI terminals.
- You do not store cardholder data electronically.
- You do not have e-commerce, MOTO, or integrated POS systems with payment applications.
- The terminal is on the PCI Council's PTS-approved device list.
- You have no administrative access to or modifications of the terminal beyond normal use.
The requirement subset
SAQ B-IP has about 80 control questions, expanding SAQ B with Requirement 1 (network security — the terminal sits on a network), Requirement 4 (encryption in transit), Requirement 6 (vulnerability management for the network it sits on), and Requirement 11 (quarterly ASV scans of the network if internet-facing).
Critical: the network the terminal sits on becomes scope. A segregated VLAN for terminals, with firewall rules that only allow outbound to the payment processor IPs, is the conventional pattern. The same WiFi network as the staff laptops and customer guest WiFi is not adequate.
Common SAQ B-IP pitfalls
- Putting terminals on the same flat WiFi as everything else — pulls every other system into scope.
- Using a terminal that is technically PTS-approved as a model but where you have an admin password or configure custom integrations — that takes you to SAQ C or D.
- Skipping ASV scans because "it is just a terminal" — the requirement applies to the network.
- Treating a terminal that integrates with a tablet POS as SAQ B-IP — integrated POS makes it SAQ C.
A worked example
A boutique restaurant accepts cards via two Verifone V400 terminals on a dedicated VLAN with firewall rules permitting only outbound traffic to the processor's payment IPs. Staff have no admin access to the terminals; the terminal vendor handles firmware updates remotely. Quarterly ASV scans run against the terminal VLAN's public IPs. The merchant signs SAQ B-IP annually with the TPSP attestation, the ASV scan attestations, and the network segmentation diagram.
Total: 3-5 weeks first time, 1-2 weeks revalidation.