This is connection to my previous question: Shared Database and PCI Compliance
However, this question relates to the requirement "Appendix A: Additional PCI DSS Requirements for Shared Hosting Providers".
If we are a service provider, is there any requirement (or recommendation) to:
- Keep the Shared Database separate per client? i.e. a separate instance of the DB service running on a different port.
- Have separate processes on our service where we decrypt data that may contain CHD? e.g. for our first client we use port 443, for our second client we use port 444, etc.
We do not store or process card data, we only decrypt it, analyse it and then re encrypt it for transmission. The Shared Database contains configuration information for certain parameters for our service, but it is not possible for a client to configure it in such a way that it will affect other clients.
Also, the processes for our service do not run client code. It is our own application. I mention this as the A.1.1 states:
A.1.1 Ensure that each entity only runs processes that have access to that entity’s cardholder data environment.
Although the guidance states:
If a merchant or service provider is allowed to run their own applications on the shared server, these should run with the user ID of the merchant or service provider, rather than as a privileged user
As our applications run only our code (not any code by our clients), how does this affect the interpretation of A.1.1? The definition in the Testing Procedure is:
If a shared hosting provider allows entities (for example, merchants or service providers) to run their own applications, verify these application processes run using the unique ID of the entity.
and my interpretation was that the running code was not a merchant's "own application", however our QSA believes that this requirement applies.
My question comprises of the two closely related questions above (in bold) relating to how much separation is required.