Req 2.6 Shared hosting providers must protect each entity's hosted environment and data. What must they meet?

Req 2.6 Shared hosting providers must protect each entity's hosted environment and data. What must they meet?

• A. Shared hosting providers must protect each entity's hosted environment and data per Appendix A
• B. Shared hosting providers can share data openly
• C. Shared hosting providers are exempt from PCI DSS
• D. It only applies to large providers

Answer: (A)

The main idea is that in a shared hosting setup, the provider must apply PCI DSS controls to every customer's hosted environment and data, treating each customer’s cardholder data environment separately. This means meeting the applicable PCI DSS requirements for each hosted account, and doing so in a way that keeps tenants isolated and protected from one another. Appendix A provides the guidance for how service providers implement and demonstrate compliance across multiple customers, clarifying that controls apply to each entity's environment within the shared facility. Data cannot be shared openly, since PCI DSS requires protection and controlled access to cardholder data. The PCI DSS framework applies to all service providers handling cardholder data, not just large ones, so size isn’t a factor.

The main idea is that in a shared hosting setup, the provider must apply PCI DSS controls to every customer's hosted environment and data, treating each customer’s cardholder data environment separately. This means meeting the applicable PCI DSS requirements for each hosted account, and doing so in a way that keeps tenants isolated and protected from one another. Appendix A provides the guidance for how service providers implement and demonstrate compliance across multiple customers, clarifying that controls apply to each entity's environment within the shared facility.

Data cannot be shared openly, since PCI DSS requires protection and controlled access to cardholder data. The PCI DSS framework applies to all service providers handling cardholder data, not just large ones, so size isn’t a factor.