Which SAQ applies to a merchant using a validated P2PE solution listed on the PCI SSC website?

• A. SAQ C
• B. SAQ A
• C. SAQ P2PE
• D. SAQ B-IP

Answer: (C)

Using a validated P2PE solution that is listed on the PCI SSC website reduces the merchant’s PCI DSS scope because card data is encrypted at the point of capture and only decrypted inside the secure P2PE component. With this setup, the merchant’s systems never handle unencrypted cardholder data, so the appropriate assessment is the P2PE SAQ. This SAQ is specifically designed for merchants who rely on a validated P2PE solution and validates that the solution is active, listed, and properly implemented, confirming the reduced exposure and the merchant’s responsibilities within that environment.

The other SAQs fit different payment scenarios. SAQ C is for merchants using payment applications connected to the internet without a P2PE solution. SAQ B-IP covers merchants with standalone payment devices connected over IP but not using a validated P2PE. SAQ A is for merchants who have fully outsourced card data processing with no electronic CHD storage on their premises. SAQ D covers all other environments that don’t match the P2PE model. Therefore, the P2PE SAQ is the correct and best fit.