When SAQ P2PE stops applying
| If | You likely move to | What that adds |
|---|---|---|
| Your terminals are encrypted but not a PCI-listed P2PE solution | SAQ B-IP or SAQ C | ASV scans and segmentation testing if used |
| You add a website that takes payments through a hosted payment page | SAQ A for that channel | Quarterly ASV scans |
| You store card data on any computer | SAQ D for merchants | Full penetration testing and scanning |
Who qualifies for SAQ P2PE
The official SAQ P2PE lists these conditions. All must be true for this payment channel:
- All payment processing goes through a validated, PCI-listed P2PE solution.
- The only systems in your business that store, process or transmit card data are the terminals from that P2PE solution.
- You do not otherwise receive, send or store card data electronically.
- Any card data you keep is on paper only and is never received electronically.
- You have put in place every control in the P2PE Instruction Manual (PIM) from your P2PE solution provider.
SAQ P2PE can apply to in-person and mail or phone order merchants who key orders only into the P2PE terminal. It does not apply to ecommerce or to service providers.
How to confirm your solution is P2PE
Ask your processor whether your terminals are part of a validated P2PE solution, then look it up on the PCI Security Standards Council list of validated P2PE solutions. "Encrypted" or "end-to-end encrypted" terminals are not the same as a PCI-listed P2PE solution.
How Clone Systems can help
PCI SAQ Finder
Confirm SAQ P2PE still fits in a few minutes.
PCI ASV scanning
Needed as soon as you add a website or a non-P2PE terminal, from $185 a year.
Penetration testing when someone asks for it
Cyber insurers and business customers often ask for a pen test even when PCI does not. Automated external tests from $1,995.