My company is in the process of selecting a Web hosting company for our website and we're trying to determine how...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
PCI DSS should affect our decision. What should we be aware of when looking for a PCI-compliant Web hosting company?
Ask the expert
Got a vexing problem for Mike Chapple or any of our other experts? Ask your enterprise-specific questions today! (All questions are anonymous.)
Presumably the Web hosting company will be involved in processing credit card transactions for the website. If this is the case, they clearly qualify as a service provider under the provisions of PCI DSS, and there are specific contractual obligations that you must follow to ensure that your organization remains PCI DSS compliant.
First, you must have a written agreement with your service provider which acknowledges that it will remain PCI DSS compliant for all interactions with cardholder information performed on behalf of your company. This may be handled by a PCI DSS clause in the contract for services or in a separate written agreement.
Second, clearly identify which elements of PCI DSS are addressed by the service provider and which are addressed by internal controls. This requirement is designed to prevent controls from slipping through the cracks, with each entity believing that compliance is the other entity's responsibility.
Third, annually validate that the service provider is PCI DSS compliant. You may do this by verifying its inclusion on the Visa Global Registry of Service Providers or by requiring the service provider to submit documentation attesting to its compliance.
Finally, you are responsible for maintaining documentation about the relationship with the service provider. This includes keeping a list of service providers that you use, maintaining the list of PCI DSS responsibility divisions and maintaining a formal process for selecting service providers that includes proper due diligence.
Dig Deeper on PCI Data Security Standard
Related Q&A from Mike Chapple
A proposed cyberattack information database in the U.K. aims to improve cyberinsurance. Expert Mike Chapple explains what collecting data breach ...continue reading
The proposed CFTC regulations on cybersecurity testing are set to finalize in 2016. Expert Mike Chapple discusses the effects these regulations have ...continue reading
Whether Apple is a HIPAA covered entity was called into question when it advertised for a health regulations lawyer. Expert Mike Chapple discusses ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.