Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)
Shared Responsibility and Cloud Provider Compliance
This domain tests whether you can separate what the provider proves from what you must prove, and map that to the v4.0 third-party requirements.
A cloud provider is a third-party service provider (TPSP) when it stores, processes or transmits CHD on your behalf, or when it could impact the security of your CDE - hypervisor administration and key custody are the classic examples. Requirement 12.8 covers managing TPSPs: a maintained list (12.8.1), written agreements (12.8.2), due diligence (12.8.3), monitoring of compliance status at least annually (12.8.4), and information about which requirements each provider handles (12.8.5). Requirement 12.9 requires the provider's written acknowledgment that it is responsible for the CHD it holds and will notify you of a breach.
The provider's AOC covers the provider's own environment, typically its infrastructure services. It never covers your configuration of IAM, encryption, logging or patching. Build a responsibility matrix per service, not per provider, because a managed database and a serverless function inherit different controls. v4.0.1 (June 2024) added no new requirements but clarified wording; the future-dated requirements became mandatory on 31 March 2025, which changes what you should expect in provider attestations.
Worked example. A SaaS company runs on IaaS. Its matrix assigns physical and hypervisor controls to the provider and OS patching, IAM, key policy and log retention to itself. A customer's assessor asks for evidence of 12.9 acknowledgment. The company must show the provider's acknowledgment for the IaaS services in scope and its own acknowledgment issued to its customers. Presenting only the provider's AOC fails both tests: it is neither your acknowledgment nor evidence of your controls.
Traps. "Inherited compliance"; accepting a SOC 2 report as PCI validation; assuming every service in a provider's catalog is covered by its AOC; letting contract renewals pass without the 12.8.2 clauses.