I did a pre-assessment of 2 web shops of one company today.
One web shop uses Direct Post based forms to insert and forward cardholder data. Doing this means the company is eligible for an SAQ A-EP. It's hosted in Azure, in a small environment, which is isolated from the rest.
The other one uses a hosted iFrame solution from a PCI compliant 3rd party. This could be done with an SAQ A. It's hosted in their own data-center though.
Does this mean that the company needs to follow the requirements from the SAQ A-EP globally, for both shops? Or can I scope the requirements per shop individually? And apply the SAQ A for the one shop and the A-EP for the other? At least based on the requirements that should be possible.