Do you need to validate compensating controls of a certified organization?

Question

Our web application uses Google's G Suite Single Sign-on for authentication into our application. As part of writing documentation around compensating controls, the PCI DSS requires "Validation of Compensating Controls" (Note that we're not being assessed for PCI compliance, we're literally just documenting the points listed for Compensating Controls)

On https://gsuite.google.com/intl/en_us/security/, Google is ISO 27001 and PCI certified. Would listing these be enough to cover the validation, or would we personally be required to validate the controls?

Answer 1

You should be able to link to an existing certification from your own documentation. Referencing, and providing links to, their existing certification as a compensating control in your documentation should serve as validation. In effect you are chaining the documentation sources together which in many cases will make it easier for the 3rd Party Auditor/Assessor as they can verify the existing certification rather than wading through your reproduction/validation of already existing documentation. However, you should ascertain whether the certification itself meets the requirements and is valid to the best of your ability before adding it as a compensating control.