Here is the scenario: A financial institution outsourced all PCI-DSS related activities. Therefore (in theory), it does not store, transmit, or process credit/debit card data. It also issues debit cards but, it only initiates the process by taking basic client information. Then, the information is forwarded to a service provider that issues and sends the debit card to the client. However, the company has been required to be PCI-DSS compliant. In my humble opinion, PCI-DSS has not been 'designed' to work for financial institutions. It is more focused on service providers and merchants. In fact, the SAQs are for merchants and service providers only. I am not aware of a SAQs for financial institutions.
Questions: 1. How can that financial institution prove that it is PCI-DSS compliant? What tools and processes can they use considering that the current ones are designed for merchants and service providers (e.g. SAQs)? 2. Can they use the SAQ (if so, which one?)to evaluate their compliance and put N/A on the related not applicable requirements? Can they use the prioritised approach? 3. If a requirement is N/A because it has been outsourced, who does own the responsibility to the requirement, the financial institution or the outsourcing company that handles the credit card information? In other words, am I correct in assuming that even if the financial institution outsources all the credit/debit card processes, it is still responsible to make sure that the outsourcing company is PCI-DSS compliant?