Which SAQ applies to a merchant using an end-to-end encryption solution (E2EE) that utilizes PCI PTS-approved POI devices which communicate with the acquirer over an IP network?

Which SAQ applies to a merchant using an end-to-end encryption solution (E2EE) that utilizes PCI PTS-approved POI devices which communicate with the acquirer over an IP network?

• A. SAQ C
• B. SAQ A
• C. SAQ P2PE
• D. SAQ B-IP

Answer: (D)

End-to-end encryption with PCI PTS POI devices that connect to the acquirer over an IP network keeps card data out of the merchant’s systems, but the data path still travels over the merchant’s IP network. The SAQ that fits this setup is the version for IP-connected POS devices, since it specifically covers merchants whose POS devices are on an IP network and do not store cardholder data on their systems. The P2PE option is reserved for merchants using a PCI-validated P2PE solution where decryption and processing occur strictly within the P2PE provider’s secure environment; if you don’t have that fully validated P2PE arrangement, you use SAQ B-IP. In short, IP-connected, non-storing POS with encryption at the device aligns with SAQ B-IP.

End-to-end encryption with PCI PTS POI devices that connect to the acquirer over an IP network keeps card data out of the merchant’s systems, but the data path still travels over the merchant’s IP network. The SAQ that fits this setup is the version for IP-connected POS devices, since it specifically covers merchants whose POS devices are on an IP network and do not store cardholder data on their systems. The P2PE option is reserved for merchants using a PCI-validated P2PE solution where decryption and processing occur strictly within the P2PE provider’s secure environment; if you don’t have that fully validated P2PE arrangement, you use SAQ B-IP. In short, IP-connected, non-storing POS with encryption at the device aligns with SAQ B-IP.