SAQ B — Imprint and dial-out terminals

SAQ B covers merchants with old-school imprint machines (the carbon-copy zip-zap) or standalone payment terminals that dial out via PSTN. No internet-connected terminals. No e-commerce. No phone payments through a soft phone.

If you store imprint slips in a locked cabinet, fine. If you scan them or type them into a computer, you've broken SAQ B scope.

Terminals are kept in areas that aren't accessible to the general public — behind the counter, not on the customer side.

List every terminal: make, model, serial number, location. Update when devices are moved, replaced, or retired.

Evidence: Terminal inventory document

Train staff to spot a skimmer or modified terminal. Inspect daily and log it. The log doesn't need to be fancy — a tick-box per terminal per day is enough.

Evidence: Daily inspection log

Imprint slips and merchant copies of receipts go in a locked drawer or safe. Not in a tray on the counter.

Cross-cut shred or pulp anything containing card data when you don't need it any more. A stationery shredder is fine if it's cross-cut.

Evidence: Destruction log or witnessed-destruction certificate

Even if your old terminal somehow records it, don't keep printed copies. Truncated PAN (last 4 digits) is fine on receipts.

Same as SAQ A — one document, signed by a director, reviewed annually. For SAQ B it can be very short because the environment is so simple.

Evidence: Signed policy document

Every staff member who handles cards gets trained on PCI basics when they start, and a refresh once a year. Keep a sign-off sheet.

Evidence: Training records

Two pages. Who to call if a terminal looks tampered with. Who to call if you suspect a breach. Test it once a year.