Does SAQ B require an ASV scan?

No. SAQ B has no Requirement 11 items. Dial-out terminals do not connect to the internet, so there is nothing for an ASV scan to test.

My terminal uses Wi-Fi or an Ethernet cable. Is that still SAQ B?

No. A terminal that connects over the internet points to SAQ B-IP, which requires quarterly ASV scans.

Can I use SAQ B for phone orders?

Yes, if you key phone or mail orders into the same standalone dial-out terminal or imprint machine and do not store the card data electronically.

Who decides which SAQ I use?

Your acquiring bank or the payment brands. Clone Systems is a PCI Approved Scanning Vendor, not a QSA.

Does SAQ B Require a Penetration Test? No. Here Is What It Does Require

Does SAQ B require a penetration test?

PCI DSS v4.0.1. Last reviewed October 2026.

No. SAQ B has no Requirement 11 section, so it does not require a penetration test, internal scans or ASV scans. It is for merchants that take cards only with imprint machines or standalone terminals that dial out over a phone line, with no internet connection and no card data stored electronically.

When SAQ B stops applying

If you add	You likely move to	What that adds
An internet-connected (IP) terminal	SAQ B-IP	Quarterly ASV scans and segmentation testing if used
A point-of-sale system or payment software on a computer	SAQ C	Quarterly internal and ASV scans and segmentation testing if used
A website that takes payments through a hosted payment page	SAQ A	Quarterly ASV scans
Stored card data on any computer	SAQ D for merchants	Full penetration testing and scanning

Who qualifies for SAQ B

The official SAQ B lists these conditions. All must be true for this payment channel:

You use only an imprint machine and/or standalone dial-out terminals connected over a phone line to your processor.
The terminals are not connected to any other systems in your business.
The terminals are not connected to the internet.
You do not store card data electronically.
Any card data you keep is on paper only, such as receipts or printed reports, and is never received electronically.

SAQ B can apply to in-person and mail or phone order merchants. It does not apply to ecommerce or to service providers.

How Clone Systems can help

PCI SAQ Finder

Not sure SAQ B still fits? Answer the eligibility questions in a few minutes.

PCI ASV scanning

Needed as soon as you add an IP terminal or a website, from $185 a year.

Penetration testing when someone asks for it

Cyber insurers and business customers often ask for a pen test even when PCI does not. Automated external tests from $1,995.

One team for 11.3 and 11.4

Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment.