What SAQ B-IP asks for in Requirement 11
| Requirement | In plain language | How often |
|---|---|---|
| 11.4.5 | Penetration test of segmentation controls, if you use segmentation to isolate the terminals, by a qualified and independent tester | Every 12 months and after changes to segmentation |
| 11.3.2 | External vulnerability scans by a PCI Approved Scanning Vendor, with a passing result | Every 3 months |
Why segmentation matters for IP terminals
Standalone IP terminals often share a network with office computers, guest Wi-Fi or point of sale systems. Segmentation keeps those systems out of PCI scope. The test confirms that nothing else on your network can reach the terminals. If it can, the rest of the network may fall into scope and SAQ B-IP may no longer apply. Our guide on proving SAQ B-IP eligibility walks through the checks.
What your assessor or acquirer will look for
- Results from the most recent segmentation test.
- Proof that every segmentation method in use was tested.
- Evidence that the tester was qualified and independent.
- Four quarters of passing ASV scans.
How Clone Systems covers SAQ B-IP
Segmentation penetration test
Clone Systems engineers test your segmentation remotely and confirm the terminals are isolated, with a written report and free retest. Covers 11.4.5.
PCI ASV scanning
Quarterly external scans by an Approved Scanning Vendor since 2007, from $185 a year. Covers 11.3.2.
Who runs your test
Clone Systems penetration testers hold CISSP, CMMC Certified Professional (CCP), API Penetration Testing (APIsec University), Hack The Box Dante Pro Lab, DevOps for Pentesters (Zero-Point Security), Practical Malware Analysis (TCM Security) and Targeted Malware Reverse Engineering (Kaspersky) credentials, and work alongside PCI ASV qualified staff. Every test is remote; we do not perform on-site testing.