We’re rewarding the question askers & reputations are being recalculated! Read more.
2 added 132 characters in body
source | link

The 'scope' that you define is the key to this. You have to justify (according to PCI-DSS rules) that a network (like your office) is not in scope. Then you don't have to worry about that (as long as nothing changes that affects the scope).

As for 3rd party hosting, you need the details from them. They should not be new to PCI-DSS questions. It is possible that they are simply not PCI-DSS compliant, and you will have to review whether they are an appropriate hosting provider for your company.

You are required to use a PCI-compliant 3rd party as outlined in the "Before You Begin" section of the standard (page iii).

The 'scope' that you define is the key to this. You have to justify (according to PCI-DSS rules) that a network (like your office) is not in scope. Then you don't have to worry about that (as long as nothing changes that affects the scope).

As for 3rd party hosting, you need the details from them. They should not be new to PCI-DSS questions. It is possible that they are simply not PCI-DSS compliant, and you will have to review whether they are an appropriate hosting provider for your company.

The 'scope' that you define is the key to this. You have to justify (according to PCI-DSS rules) that a network (like your office) is not in scope. Then you don't have to worry about that (as long as nothing changes that affects the scope).

As for 3rd party hosting, you need the details from them. They should not be new to PCI-DSS questions. It is possible that they are simply not PCI-DSS compliant, and you will have to review whether they are an appropriate hosting provider for your company.

You are required to use a PCI-compliant 3rd party as outlined in the "Before You Begin" section of the standard (page iii).

1
source | link

The 'scope' that you define is the key to this. You have to justify (according to PCI-DSS rules) that a network (like your office) is not in scope. Then you don't have to worry about that (as long as nothing changes that affects the scope).

As for 3rd party hosting, you need the details from them. They should not be new to PCI-DSS questions. It is possible that they are simply not PCI-DSS compliant, and you will have to review whether they are an appropriate hosting provider for your company.