When filling in the SAQ for PCI compliance, how do you include requirements covered by a third party provider? Say you're using a PCI compliant VPS provider for example.
Do you select 'yes' then include a reference to the third party's AoC? Or is it considered a compensating measure? Or just not applicable and fill out the worksheet?
There must be information in one of the PCI council documents but I couldn't find it.