Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
When filling in the SAQ for PCI compliance, how do you include requirements covered by a third party provider? Say you're using a PCI compliant VPS provider for example.
Do you select 'yes' then include a reference to the third party's AoC? Or is it considered a compensating measure? Or just not applicable and fill out the worksheet?
There must be information in one of the PCI council documents but I couldn't find it.
You could select In Place but there's nowhere to justify that it's In Place and you've outsourced the responsibility. In the case of an SAQ, it's clearer to select Not Applicable, and then to justify the Not Applicable selections with a statement such as:
'Not applicable as responsibility for meeting this control has been outsourced to X service provider. Their AOC, dated dd mmm yyyy, has been reviewed and shows that this requirement is In Place'.
