Does SAQ SPoC require an ASV scan?

No. SAQ SPoC has no Requirement 11 items.

Does any tap-to-pay app qualify?

No. Only solutions validated and listed by the PCI Security Standards Council as SPoC solutions qualify for SAQ SPoC. Ask your processor.

Can I use the same phone for other things?

Yes. The SAQ allows general-purpose phones and tablets, as long as you follow the SPoC user guide and the payment channel is not connected to your other systems.

Who decides which SAQ I use?

Your acquiring bank or the payment brands. Clone Systems is a PCI Approved Scanning Vendor, not a QSA.

Does SAQ SPoC Require a Penetration Test? No. Here Is What It Does Require

Does SAQ SPoC require a penetration test?

PCI DSS v4.0.1. Last reviewed October 2026.

No. SAQ SPoC has no Requirement 11 section, so it does not require a penetration test, internal scans or ASV scans. It is for merchants that take in-person payments with a phone or tablet and a secure card reader that are part of a validated, PCI-listed Software-based PIN Entry on COTS (SPoC) solution.

When SAQ SPoC stops applying

If	You likely move to	What that adds
Your app and reader are not part of a PCI-listed SPoC or P2PE solution	SAQ C or SAQ D	Scanning and testing requirements
You take phone or mail orders	Another SAQ for that channel	Use the SAQ Finder
You add a website that takes payments through a hosted payment page	SAQ A for that channel	Quarterly ASV scans

Who qualifies for SAQ SPoC

The official SAQ SPoC lists these conditions. All must be true for this payment channel:

All payment processing is card-present only.
All card entry is through a secure card reader for PIN (SCRP) that is part of a validated SPoC solution listed by the PCI Security Standards Council.
The only systems that store, process or transmit card data are those in the validated SPoC solution.
You do not otherwise receive, send or store card data electronically.
This payment channel is not connected to any other systems or networks in your business.
Any card data you keep is on paper only and is never received electronically.
You have put in place every control in the SPoC user guide from your solution provider.

SAQ SPoC does not apply to kiosks, self-checkout, mail or phone orders, ecommerce, or service providers. Merchants using magnetic stripe readers that are not PTS-listed are not eligible.

How Clone Systems can help

PCI SAQ Finder

Confirm SAQ SPoC still fits in a few minutes.

PCI ASV scanning

Needed as soon as you add a website or another internet-connected payment channel, from $185 a year.

Penetration testing when someone asks for it

Cyber insurers and business customers often ask for a pen test even when PCI does not. Automated external tests from $1,995.

One team for 11.3 and 11.4

Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment.