Let's say there is a company (name: X) which is PCI certified and compliant as a merchant. In terms of PCI compliance, what does company X has to consider while working with third parties? E.g. for a business reason company X needs to forward hashed PAN numbers to a third-party provider (name: Y). What does company X have to do in order not to violate PCI compliance? Is there a document I can read from?

Thank you,