Shared host that is not a service provider, with no SAQ/AoC. Is compliance possible?

Question

Shared web host says they are not a service provider and have no attestation of compliance or SAQ. But they say they are PCI compliant.

According to SAQ, it would seem like I couldn't be compliant on their hosting:

• If merchant website is hosted by a third-party provider, the provider is validated to all applicable PCI DSS requirements (e.g., including PCI DSS Appendix A if the provider is a shared hosting provider);
• All elements of payment pages that are delivered to the consumer’s browser originate from either the merchant’s website or a PCI DSS compliant service provider(s);

This is very surprising since they are a fairly large US host specifically saying they are pci compliant.

Can I be compliant on their hosting?

Answer 1

In your previous question, you indicated that you need to complete an SAQ-A-EP. Since all of your infrastructure is being provided by the hosting provider, you are relying on their PCI compliance. You are being placed in a difficult situation since they are not providing an Attestation of Compliance. They can say they are compliant but unless they provide an AoC then you only have their word. If you can't demonstrate the compliance status of your service providers, you run the risk of not meeting requirement 12.8.

Here are a few options:

• Check the Visa Registry of Service Providers to see if they are listed.
• Contact the hosting provider directly either through a relationship or customer manager. Ask them how you can be compliant without their AoC.
• Talk with your acquiring bank. Since you are accountable to them regarding your compliance, ask them for guidance. They can give you suggestions for how to address the situation to their satisfaction.
• Look for another hosting provider. Yes, this isn't optimal but if the hosting provider consistently pushes back on demonstrating their compliance, and your compliance is vital enough, then the hosting provider is increasing your risk. Many hosting providers actively publish their AoCs. For example, Microsoft publishes the AoC for Azure.