Appendix A: Additional PCI DSS Requirements for Shared Hosting Providers This appendix is not used for merchant assessments. Appendix B: Compensating Controls Worksheet Use this worksheet to define compensating controls for any requirement where with CCW” was “YES checked. Note: Only companies that have undertaken a risk analysis and have legitimate technological or documented business constraints can consider the use of compensating controls to achieve compliance. Refer to Appendices B, C, and D of PCI DSS for information about compensating controls and guidance on how to complete this worksheet. Requirement Number and Definition: Information Required Explanation Constraints List constraints precluding compliance with the original requirement. Objective Define the objective of the original control; identify the objective met by the compensating control. Identify any additional risk posed by the Identified Risk lack of the original control. Definition of Define the compensating controls and Compensating explain how they address the objectives Controls of the original control and the increased risk, if any. Validation of Define how the compensating controls Compensating were validated and tested. Controls Maintenance Define process and controls in to maintain compensating controls. Appendix C: Explanation of Non-Applicability If the (Not Applicable) column was checked in the questionnaire, use this worksheet to explain why “N/A” the related requirement is not applicable to your organization. Requirement Reason Requirement is Not Applicable Example: 3.4 Cardholder data is never stored electronically
Appendix A: Additional PCI DSS Requirements for Shared Hosting Providers This appendix is not used for merchant assessments. Appendix B: Compensating Controls Worksheet Use this worksheet to define compensating controls for any requirement where “YES with CCW” was checked. Note: Only companies that have undertaken a risk analysis and have legitimate technological or documented business constraints can consider the use of compensating controls to achieve compliance. Refer to Appendices B, C, and D of PCI DSS for information about compensating controls and guidance on how to complete this worksheet. Requirement Number and Definition: Information Required Explanation Constraints List constraints precluding compliance with the original requirement. Objective Define the objective of the original control; identify the objective met by the compensating control. Identified Risk Identify any additional risk posed by the lack of the original control. Definition of Compensating Controls Define the compensating controls and explain how they address the objectives of the original control and the increased risk, if any. Validation of Compensating Controls Define how the compensating controls were validated and tested. Maintenance Define process and controls in to maintain compensating controls. Appendix C: Explanation of Non-Applicability If the “N/A” (Not Applicable) column was checked in the questionnaire, use this worksheet to explain why the related requirement is not applicable to your organization. Requirement Reason Requirement is Not Applicable Example: 3.4 Cardholder data is never stored electronically
PCI_DSS_v3-1_SAQ_A-EP_rev1-1.docx