Which SAQ applies to a merchant with only card-present dial-out terminals?

Which SAQ applies to a merchant with only card-present dial-out terminals?

• A. SAQ B
• B. SAQ A
• C. SAQ C
• D. SAQ P2PE

Answer: (A)

This question tests PCI DSS scope—which SAQ fits when you truly only have card-present, dial-out terminals that connect to the processor and you don’t store cardholder data electronically on your systems. In this setup, the merchant’s environment is limited to the physical terminals and the dial path to the processor, with no CHD stored on the merchant’s devices or networks. That configuration is precisely what the SAQ designed for card-present dial-out devices covers. The reason this is the best fit is that SAQ categories are defined by how card data is handled and where it’s stored or processed. A setup with only standalone, dial-out card-present terminals falls under a category that assumes no electronic storage of CHD on the merchant’s systems and no internet-connected payment applications, focusing controls on protecting those terminals and the direct connection to the processor. The other options don’t align with this scenario. A card-not-present outsourced model involves processing that occurs externally and typically targets merchants that do not handle CHD electronically or that rely entirely on hosted solutions for card-not-present transactions. An internet-connected POS scenario would require an SAQ that accounts for online or networked POS components. A P2PE approach presumes the use of a validated point-to-point encryption solution, which changes the data flow and scope beyond a simple dial-out terminal environment.

This question tests PCI DSS scope—which SAQ fits when you truly only have card-present, dial-out terminals that connect to the processor and you don’t store cardholder data electronically on your systems. In this setup, the merchant’s environment is limited to the physical terminals and the dial path to the processor, with no CHD stored on the merchant’s devices or networks. That configuration is precisely what the SAQ designed for card-present dial-out devices covers.

The reason this is the best fit is that SAQ categories are defined by how card data is handled and where it’s stored or processed. A setup with only standalone, dial-out card-present terminals falls under a category that assumes no electronic storage of CHD on the merchant’s systems and no internet-connected payment applications, focusing controls on protecting those terminals and the direct connection to the processor.

The other options don’t align with this scenario. A card-not-present outsourced model involves processing that occurs externally and typically targets merchants that do not handle CHD electronically or that rely entirely on hosted solutions for card-not-present transactions. An internet-connected POS scenario would require an SAQ that accounts for online or networked POS components. A P2PE approach presumes the use of a validated point-to-point encryption solution, which changes the data flow and scope beyond a simple dial-out terminal environment.