2

I am trying to find clarification regarding PCI Compliance SAQ A-EP and third party hosting solutions.

In order to achieve SAQ A-EP PCI Compliance using "Hosting Company A" is it necessary for "Hosting Company A" to be a Certified PCI Compliant Service Provider?

Feel free to expand your response as necessary, but what I am hoping to find is a Yes or No answer and "why".

Improve this question

1 Answer 1

Reset to default
2

Yes, SAQ A-EP requires your hosting provider be validated to all applicable PCI DSS requirements.

To quote the SAQ A-EP itself (emphasis mine):

SAQ A-EP merchants confirm that, for this payment channel:

...

  • If merchant website is hosted by a third-party provider, the provider is validated to all applicable PCI DSS requirements (e.g., including PCI DSS Appendix A if the provider is a shared hosting provider);
  • All elements of payment pages that are delivered to the consumer’s browser originate from either the merchant’s website or a PCI DSS compliant service provider(s);
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .