PCI DSS for companies that host, process or manage payment environments for others: scoping shared cloud environments, responsibility matrices, SaaS platforms in the payment flow and managed service providers with access to customer CDEs.
How to scope a cardholder data environment that runs on cloud services: responsibility that cannot be outsourced, which provider services were actually assessed, responsibility matrices, multi-tenant provider requirements and the 2024 scoping guidance.
Building the record of which PCI DSS requirements a provider meets, which the customer meets and which are shared: what 12.8.5 and 12.9.2 require, provider evidence and AOCs, cloud provider matrices and what happens when a provider cannot show evidence.
What PCI DSS asks of a SaaS company in its customers' payment flow: when it is a service provider, assessment scope, multi-tenant requirements, customer penetration testing support, SAQ D versus ROC, and the Secure Software Standard for SaaS.
When an MSP or MSSP that never touches card data still falls under PCI DSS: impact on a customer's CDE, scope of its own assessment, remote access and MFA rules for vendors, written acknowledgments to customers and evidence of the requirements it meets.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.