Which SAQ Do I Need? SAQ A vs SAQ A-EP vs SAQ B-IP Explained
The right PCI DSS self-assessment questionnaire (SAQ) is chosen by how card payments actually flow through your business, not by your business size. If your site redirects customers straight to a processor-hosted checkout, you use SAQ A. If a processor payment page is embedded on your own website, or card details are collected by phone or email, you use SAQ A-EP. Standalone PTS-approved terminals that never connect to other device types in the same network zone use SAQ B-IP. Under PCI DSS v4, a wrong SAQ choice is expensive: the global average data breach cost reached $4.99 million in IBM's 2026 Cost of a Data Breach report [1]. Clone Systems' PCI ASV scanning package starts at $185 a year and confirms your choice [3].
Most small businesses pick a SAQ because it is short. Then the acquirer's reviewer walks through the payment flow, finds the first place card data actually touches the business's own systems, and the self-assessment fails. IBM's 2026 Cost of a Data Breach report puts the global average breach cost at $4.99 million, a 12% increase year over year and a record high [1], which is why the questionnaire you sign has to match the flow you actually run, not the flow you assumed you ran. In our assessments, the SAQ mis-selection we see most often is B-IP, where the merchant is certain the terminals are isolated, until a scan shows a support laptop or a printer in the same switch segment touching the cardholder data environment.
Three things are worth stating up front. First, under PCI DSS v4, SAQ A now includes an external ASV scanning requirement for merchants whose website redirects to or embeds a processor payment page, so the old "SAQ A means no scan" rule no longer holds, per the PCI Security Standards Council [2]. Second, the average data breach now costs $4.99 million globally, according to IBM's 2026 Cost of a Data Breach report [1]. Third, in our assessments, the wrong SAQ almost always fails at the acquirer review stage, not at submission, because the reviewer traces the actual payment flow rather than trusting the questionnaire title.
How do I know which SAQ applies to my business?
Walk the payment flow from the card to the processor and stop at the first point card data enters your own systems. The device or surface that does the collecting is what selects the SAQ.
- SAQ A applies when every transaction is fully outsourced: customers are redirected to the processor's hosted checkout page, or payment runs through a fully out-of-band method, and the merchant never stores, processes, or transmits card data itself.
- SAQ A-EP applies when a payment page is embedded in the merchant's own website (an iframe or hosted field pointing to the processor), or when card data is collected over phone, email, or mail.
- SAQ B-IP applies only to standalone PTS-approved point-of-interaction devices that are not connected to other types of devices in the same network zone, per the PCI SSC's v4 guidance [2].
The business size is not part of the test. A single-location coffee shop and a mid-size retailer can both run SAQ A if the checkout is fully hosted by the processor.
| SAQ | Payment model | Eligibility in one line | Key controls (v4) |
|---|---|---|---|
| SAQ A | Fully outsourced (redirect or out-of-band) | Merchant never stores, processes, or transmits card data | Requirement 11 external ASV scan where a website redirect or embedded payment page is present [2] |
| SAQ A-EP | Embedded page, phone, or email collection | Merchant web form or phone/email touches card data | Requirements 2, 5, 6, 7, 8, 10, 12 including web application and phishing controls [2] |
| SAQ B-IP | Standalone PTS-approved terminal | Terminal not connected to other device types in the same network zone | Requirements 3, 9 on data retention and media protection [2] |
If the flow is mixed, say a counter terminal plus an embedded web form, the business runs the SAQ that covers the highest-touch path, usually SAQ A-EP.
What does an isolated network zone require for SAQ B-IP?
An isolated network zone is a physically or logically separate segment in which only the PTS-approved terminal(s) and their required supporting devices sit, and nothing else shares that segment. The PCI SSC clarified in its v4 guidance that SAQ B-IP is intended only for standalone PTS-approved POI devices that are not connected to other types of devices in the same network zone [2].
The practical failures we see:
- A support laptop or vendor tablet that connects to the same switch as the terminal to "check something."
- A shared Wi-Fi segment where the terminal and office devices coexist.
- A printer or POS back-office PC on the same VLAN that the terminal uses.
- A terminal that "happens" to be dual-homed to a second network for backup.
If any of those are true, B-IP is not available, and the business should re-scope to SAQ A-EP or a fuller assessment. Clone Systems' PCI ASV scanning service includes a scope review that walks the flow against the SAQ definition before the first scan is run.
Did PCI DSS v4 change what SAQ A requires?
Yes, in two ways that most small merchants missed, per the PCI Security Standards Council [2].
First, SAQ A now carries an external ASV scanning requirement where the merchant's website redirects to a processor-hosted payment page or embeds a processor payment page or form. The Council's v4 guidance lists this explicitly under Requirement 11 for SAQ A [2]. Before v4 this was a common source of confusion because many merchants assumed SAQ A meant no scan of any kind.
Second, the future-dated v4 requirements, which could be marked "Not Applicable" with documentation before 31 March 2025, are now fully in force [2]. Any control that was deferred is now a live requirement in the SAQ you sign.
A related tightening: the Council's v4 guidance narrows SAQ B-IP to standalone PTS-approved POI devices that are not connected to other types of devices in the same network zone, which rules out more "we thought we were isolated" setups than v3 did [2].
Does SAQ A still mean no scanning?
For SAQ A under PCI DSS v4, if your website redirects to or embeds a processor payment page, an external ASV scan is now part of the questionnaire [2]. The old shortcut, "SAQ A means we do not scan," is gone. In our assessments, this is the change that most often surprises merchants at the acquirer review stage, because the prior cycle's paperwork still showed no scan obligation.
For SAQ A-EP the scanning obligation is broader, because the merchant's own web application and email surface are in scope, so the scan has to cover the merchant's infrastructure, not just the external IP range. And for SAQ B-IP, where the terminal is genuinely standalone, the scan obligation is narrower, but the isolation claim has to hold up under review.
If you need a current scan on the books, PCI ASV scanning from Clone Systems starts at $185 a year and covers the quarterly cadence the acquirer expects.
Do I need a penetration test for PCI DSS?
A SAQ on its own does not mandate a penetration test, but PCI DSS Requirement 11.4 does for many merchants, regardless of which SAQ you use. Level 1 merchants run an external scan quarterly and a penetration test at least annually, and every merchant must complete a penetration test annually where the standard applies, with segmentation testing where the cardholder data environment boundaries change. The full requirement breakdown lives at our PCI DSS penetration test requirement 11.4 page.
If your acquirer or QSA has asked for a pen test, our penetration testing buyer guide walks through what to ask a vendor before signing a statement of work.
The Clone Systems 6-Question SAQ Eligibility Checklist
Work through these six questions in order. Stop at the first one that applies and use that SAQ.
- Do your terminals stand alone on a network segment with no other device types (no laptops, no shared Wi-Fi, no back-office PC on the same VLAN)? If yes, you can use SAQ B-IP. If no, move to question 2.
- Does any payment path run fully through the processor's hosted page or a fully out-of-band method, and does your website only redirect to it? If yes and the answer to question 3 is also yes, you use SAQ A.
- Does your website ever embed a payment form, or do you take card details by phone or email? If yes, you use SAQ A-EP.
- Is there any point where your own system stores, processes, or transmits card data? If yes, you are past the simple SAQs and need a fuller assessment.
- Has your processor asked for an external ASV scan, or does your SAQ include Requirement 11? If yes, a scan is on the books, and the PCI ASV scanning package from Clone Systems starts at $185 a year covers the quarterly cadence.
- Has your acquirer, QSA, or insurer asked for a penetration test? If yes, start with our penetration testing buyer guide before engaging a vendor.
How Clone Systems Can Help
Clone Systems runs the PCI ASV scanning and scope review as one engagement. The PCI ASV scanning package starts at $185 a year, includes the quarterly scan cadence the acquirer expects, and adds a scope review that walks your actual payment flow against the SAQ definition before the first scan is run, so the questionnaire you sign matches the systems you actually run.
Comparing scanning platforms before you sign? We publish side-by-side comparisons for Clone Systems vs Qualys, Clone Systems vs Tenable, and Clone Systems vs Fortra, plus a broader vulnerability management comparison that walks the full decision.
Frequently Asked Questions
What is SAQ A for PCI DSS? SAQ A is the self-assessment questionnaire for merchants who never store, process, or transmits card data because every transaction is fully outsourced to the processor. It is the shortest SAQ and is typically used by merchants whose website redirects customers to the processor's hosted checkout.
Does SAQ A require an ASV scan under PCI DSS v4? Yes, if your website redirects to or embeds a processor payment page, the v4 SAQ A carries an external ASV scanning requirement under Requirement 11 [2]. Merchants who assumed "SAQ A means no scan" should confirm this with their acquirer now.
How do I know if I qualify for SAQ B-IP? You qualify only if you use standalone PTS-approved point-of-interaction devices that are not connected to other types of devices in the same network zone, per the PCI SSC's v4 guidance [2]. The moment a laptop, shared Wi-Fi, or back-office PC touches the same segment, B-IP is no longer available.
What is the difference between SAQ A and SAQ A-EP? SAQ A is for fully outsourced transactions where the merchant never touches card data, while SAQ A-EP applies when a payment page is embedded on the merchant's own website or card details are collected by phone or email. The extra controls in A-EP cover the merchant's own web application, email, and remote access surface.
What is included in the Clone Systems PCI ASV scanning package? The package starts at $185 a year and covers the quarterly external scan cadence, ASV certification, and a scope review of your payment flow. It is designed to keep the acquirer's paperwork current and to confirm the SAQ you are signing actually matches your environment.
Conclusion
The SAQ is not a formality. It is a claim about how card data moves through your business, and the v4 changes made the wrong claim more expensive, not cheaper. Walk the payment flow, use the 6-Question SAQ Eligibility Checklist above, and keep a current ASV scan on the books at Clone Systems, where the PCI ASV scanning package starts at $185 a year.
References
[1] IBM Security, Cost of a Data Breach Report 2026, IBM & Ponemon Institute. https://www.ibm.com/reports/data-breach [2] PCI Security Standards Council, PCI DSS v4: What's New with Self-Assessment Questionnaires (Alicia Malone, 27 Mar 2024). https://blog.pcisecuritystandards.org/pci-dss-v4-whats-new-with-self-assessment-questionnaires [3] Clone Systems, PCI ASV Scanning service page. https://www.clone-systems.com/pci-asv-scan-external-vulnerability-scanning/ [4] Clone Systems, PCI ASV scanning pricing (from $185 a year). https://www.clone-systems.com/pricing?mode=pci [5] Clone Systems, How to Prove SAQ B-IP Eligibility: The 5-Check Terminal Zone Test. https://www.clone-systems.com/blog/how-to-prove-saq-b-ip-eligibility-5-check-terminal-zone-test [6] Clone Systems, How to Choose a Penetration Testing Vendor. https://www.clone-systems.com/blog/how-to-choose-a-penetration-testing-vendor [7] Clone Systems, PCI DSS Penetration Test Requirement 11.4. https://www.clone-systems.com/pci-dss-penetration-test-requirement-11-4 [8] Clone Systems, Vulnerability Management Comparison. https://www.clone-systems.com/vulnerability-management-comparison