Ask for a walkthrough
Menu

Guide · PCI DSS

Your cloud is PCI DSS compliant. Are you?

Running on a PCI DSS compliant cloud does not make you PCI DSS compliant: you still answer for your own compliance. Your provider's Attestation of Compliance covers the services and locations named in it; what you set up, deploy and run on those services stays with you.

Applies to PCI DSS v4.0.1Last checked 13 Oct 2026Published 14 Oct 2026Written by Moshiul Islam Mishu, who has led PCI DSS assessments since 2018

In shortPCI DSS
  • Get your provider's current Attestation of Compliance and check that every service and location you use is named in it.
  • Get the provider's responsibility matrix or summary, then keep your own record of which requirements are the provider's, yours or shared (requirement 12.8.5).
  • Keep the written agreement in which the provider acknowledges its responsibility. Its Attestation of Compliance does not count as that acknowledgment (requirement 12.8.2).
  • Check the provider's compliance status at least once every 12 months (requirement 12.8.4).
  • Expect to evidence what you run on the cloud yourself: who can log in, which network rules are open, what is logged, how keys are held and how your systems are patched.
On this pageDoes a PCI DSS compliant cloud make you compliant?What does the provider’s Attestation of Compliance cover?Where do you get the AOC and the shared responsibility matrix?What stays with you on a cloud?What does PCI DSS scope reduction mean on a cloud?What an assessor will ask to seeHow the platform helpsSources

Does a PCI DSS compliant cloud make you compliant?

No. A note to requirement 12.8.1 says so: a compliant third-party service provider does not make its customer compliant, and the customer still answers for its own compliance [1]. A cloud provider is such a third party: the attestation you complete yourself names IaaS, PaaS, SaaS and FaaS cloud providers among them [1].

What changes is where the evidence comes from. Where a provider meets a requirement on your behalf, that requirement is still in scope for your assessment. If the provider gives no evidence that it meets it, it is not in place for you either [2]. And a provider’s validation does not pass by itself to what you run inside its service, such as your own virtual machines [3].

What does the provider’s Attestation of Compliance cover?

The Attestation of Compliance (AOC) is the Council’s form for declaring the result of an assessment. Read these parts of the service provider version against the services you use [4].

Part of the form What it tells you
Part 2a The services that were assessed, and the services the provider offers that were not, with the reason [4]
Part 2d The types of facility in scope, with the city and country of each [4]
Part 2g For each service, the finding against each principal requirement, with any sub-requirement marked not applicable or not tested, and why [4]
Sections 2 and 3 The dates the assessment began and ended, whether it was full or partial, and the result [4]

A provider that has an AOC is expected to give it to customers on request, and it should apply to the services you use [5]. A certificate in place of the Council’s form is not accepted as evidence [6]. The Council does not require your QSA to visit the provider and test again what its current assessment already covers [7].

If a service you use is not named in the AOC, an assessor will usually ask for it to be kept out of the card data flow, or for the provider’s own evidence for it.

Where do you get the AOC and the shared responsibility matrix?

This is what each provider’s own page said on 13 October 2026: what its assessment covers, where you get its AOC, and where it sets out the split of responsibilities.

Provider What is covered The AOC The matrix
Amazon Web Services The services on its “Services in Scope by Compliance Program” page, at the locations listed in its AOC [8] AWS Artifact, after signing in to the AWS Management Console [8] The “AWS PCI DSS Responsibility Summary”, in the same package [8]
Microsoft Azure Azure, Dynamics 365, Power Platform and some Microsoft 365 services, as listed in the AOC. The page names version 4.0 [9] The PCI DSS reports section of its Service Trust Portal, with one AOC for Azure and one for Azure Government [9] The “Azure PCI DSS Shared Responsibility Matrix”, with the audit reports [9]
Google Cloud The products listed on its PCI DSS page, reviewed by a QSA against version 4.0.1 [10] Its page says PCI DSS reports may be requested through its Compliance Reports Manager [10]. “Google Cloud: PCI DSS v4.0.1 Shared Responsibility Matrix”, a public PDF dated August 2026 [11]
Alibaba Cloud Cloud products, security services and CDN services in 12 regions. The page names version 3.2.1 [12] The compliance repository in its Trust Center [12] The “Alibaba Cloud International Services PCI DSS Responsibility Management Matrix”, in the same repository [12]

Each of the four says that its own compliance does not make a customer compliant [8][9][10][12]. Read the version and the dates on the AOC itself, not on the web page. Version 3.2.1 was retired on 31 March 2024 and version 4.0 on 31 December 2024 [13][14]. You can rely on a provider validated to an older version only if that validation was completed before the version retired and is less than 12 months old [15].

What stays with you on a cloud?

It depends on the services you use: the more the provider manages, the more requirements it covers [3]. For infrastructure services, where you configure the virtual machines, networks and storage, the Council’s sample split gives the provider physical security in full and leaves the other eleven requirements shared or with you [3]. That sample dates from April 2018 and version 3.2 of the standard, so the table also draws on the providers’ current pages. Your split is the one in your provider’s matrix.

What the assessor looks at What stays with you Requirement
Who can log in Unique IDs and strong authentication for every account you control. Multi-factor authentication (MFA) into the cardholder data environment. A six-monthly review of accounts, including those used to reach cloud services [1][3] 7.2.4, 8.4.2
How networks are opened The rules within and between your own environments: which services, protocols and ports are allowed, approved and reviewed [1][3][16] 1.2.5, 1.2.7
What is logged Logging inside your own virtual machines and applications, and for anything the provider does not manage [3][11] 10.2.1
How keys are held How stored card data is encrypted, and who can reach the keys, the encrypted data, or both [3][11] 3.6.1
Patching (updates) The operating systems and applications you run [3][11][16] 6.3.3
Physical security Nothing in the provider’s data centres [3][11][12] 9

Requirement 12.8.5 asks you to keep a record of which requirements each provider manages, which you manage and which are shared [1]. A provider’s matrix helps, but the Council notes that some stop short of individual services, and that the record for your own set-up is yours to keep [17]. A copy of the provider’s matrix with your own column added, service by service, is usually accepted as that record.

Requirement 12.8.2 asks for a written agreement in which the provider acknowledges its responsibility for the account data it holds or could affect. An AOC, a responsibility matrix or a statement on a website is not that acknowledgment unless it is part of a written agreement [1]. Ask the provider where its acknowledgment is written.

Requirements 12.9.1 and 12.9.2 oblige the provider to give that acknowledgment in writing and, on request, to tell you its compliance status and which requirements are its own, yours or shared [18].

What does PCI DSS scope reduction mean on a cloud?

Moving to a cloud does not reduce your scope by itself: on a public cloud both you and the provider have systems in scope [3]. The most effective step the Council’s cloud guidance names is not to store, process or transmit card data in the cloud at all [3]. Encryption alone does not take cardholder data out of scope [19].

Segmentation is not a requirement, but without it your whole network is in scope [20]. The provider keeps its customers apart; segmentation inside your own environment is yours to set up [3]. A system is out of scope only if it is isolated so that it could not affect the security of account data even if it were compromised [17]. If you rely on segmentation, requirement 11.4.5 asks for a penetration test of it at least once every 12 months and after any change to it [1]. A service provider is asked for one at least once every six months (requirement 11.4.6) [21]. The Council’s 2024 guidance says the test should consider the boundaries between separate accounts or projects with the same provider [17].

What an assessor will ask to see

  1. Your list of third-party service providers, with the cloud provider on it and a description of each service you use (requirement 12.8.1) [1]
  2. The written agreement holding the provider’s acknowledgment (requirement 12.8.2) [1]
  3. The provider’s current AOC, checked against the services and locations you use, and your record of checking its status at least once every 12 months (requirement 12.8.4) [1][5]
  4. Your record of which requirements are the provider’s, yours or shared (requirement 12.8.5) [1]
  5. Your documented scope, with each segmentation control and the reason anything is out of scope (requirement 12.5.2), and the penetration test of those controls (requirement 11.4.5) [1]
  6. Your own evidence for each requirement that is yours or shared [3]
  7. That evidence taken from your own cloud accounts: the configuration as it stands, showing the account, the date and who took it

The requirement numbers in this guide were checked against the Council’s version 4.0.1 questionnaires: 12.9.1 and 12.9.2 in the one for service providers, the rest in the one for merchants [1][18]. Requirement 11.4.6 was checked in the version 4.0 questionnaire for service providers [21]; version 4.0.1 added and deleted no requirements [14].

How the platform helps

The platform checks your cloud accounts against PCI DSS v4.0.1, holds the evidence a cloud account cannot show, and files both by requirement. Whether a requirement is in place is for your QSA to decide, or for you on a self-assessment.

Sources

  1. Self-Assessment Questionnaire D for Merchants and Attestation of Compliance, for use with PCI DSS version 4.0.1, PCI Security Standards Council, October 2024, https://docs-prv.pcisecuritystandards.org/SAQ%20(Assessment)/SAQ/PCI-DSS-v4-0-1-SAQ-D-Merchant.pdf, read 13 October 2026
  2. FAQ 1312, “How is an entity’s PCI DSS compliance impacted by using third-party service providers (TPSPs)?”, PCI Security Standards Council, February 2024, https://www.pcisecuritystandards.org/faqs/1312/, read 13 October 2026
  3. Information Supplement: PCI SSC Cloud Computing Guidelines, version 3.0, PCI Security Standards Council, April 2018, https://listings.pcisecuritystandards.org/pdfs/PCI_SSC_Cloud_Guidelines_v3.pdf, read 13 October 2026
  4. Attestation of Compliance for Report on Compliance: Service Providers, version 4.0.1, PCI Security Standards Council, August 2024, https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Reporting%20Template%20or%20Form/PCI-DSS-v4-0-1-ROC-AOC-Service-Providers.pdf, read 13 October 2026
  5. FAQ 1576, “What evidence is a TPSP expected to provide to customers to demonstrate PCI DSS compliance?”, PCI Security Standards Council, February 2024, https://www.pcisecuritystandards.org/faqs/1576/, read 13 October 2026
  6. FAQ 1220, “Are compliance certificates recognized for PCI DSS validation?”, PCI Security Standards Council, August 2023, https://www.pcisecuritystandards.org/faqs/1220/, read 13 October 2026
  7. FAQ 1290, “If an entity uses a third-party service provider (TPSP) that has been validated as PCI DSS compliant, is the entity’s assessor required to go onsite to the TPSP’s location and retest the PCI DSS requirements?”, PCI Security Standards Council, February 2024, https://www.pcisecuritystandards.org/faqs/1290/, read 13 October 2026
  8. PCI (Payment Card Industry Standards), Amazon Web Services, https://aws.amazon.com/compliance/pci-faqs/, read 13 October 2026
  9. PCI DSS, Azure compliance, Microsoft Learn, https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-pci-dss, read 13 October 2026
  10. PCI DSS, Compliance, Google Cloud, https://cloud.google.com/security/compliance/pci-dss, read 13 October 2026
  11. Google Cloud: PCI DSS v4.0.1 Shared Responsibility Matrix, Google, August 2026, https://services.google.com/fh/files/misc/gcp_pci_dss_v4_responsibility_matrix.pdf, read 13 October 2026
  12. PCI Data Security Standards Compliance, Trust Center, Alibaba Cloud, https://www.alibabacloud.com/trust-center/pci-dss, read 13 October 2026
  13. “PCI DSS v3.2.1 is Retiring on 31 March 2024 – Are You Ready?”, PCI Security Standards Council, 31 January 2024, https://blog.pcisecuritystandards.org/pci-dss-v3-2-1-is-retiring-on-31-march-2024-are-you-ready, read 13 October 2026
  14. “Just Published: PCI DSS v4.0.1”, PCI Security Standards Council, 11 June 2024, https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1, read 13 October 2026
  15. FAQ 1282, “Can an entity be PCI DSS compliant if they use a third-party service provider (TPSP) that is validated to a previous version of PCI DSS?”, PCI Security Standards Council, November 2022, https://www.pcisecuritystandards.org/faqs/1282/, read 13 October 2026
  16. Shared Responsibility Model, Amazon Web Services, https://aws.amazon.com/compliance/shared-responsibility-model/, read 13 October 2026
  17. Information Supplement: PCI DSS Scoping and Segmentation Guidance for Modern Network Architectures, PCI Security Standards Council, September 2024, https://docs-prv.pcisecuritystandards.org/Guidance%20Document/PCI%20DSS%20General/PCI-DSS-Scoping-and-Segmentation-Guidance-for-Modern-Network-Architectures.pdf, read 13 October 2026
  18. Self-Assessment Questionnaire D for Service Providers and Attestation of Compliance, for use with PCI DSS version 4.0.1, revision 2, PCI Security Standards Council, January 2025, https://docs-prv.pcisecuritystandards.org/SAQ%20(Assessment)/SAQ/PCI-DSS-v4-0-1-SAQ-D-Service-Provider-r2.pdf, read 13 October 2026
  19. FAQ 1086, “How does encrypted cardholder data impact PCI DSS scope?”, PCI Security Standards Council, March 2026, https://www.pcisecuritystandards.org/faqs/1086/, read 13 October 2026
  20. Information Supplement: Guidance for PCI DSS Scoping and Network Segmentation, version 1.1, PCI Security Standards Council, May 2017, https://listings.pcisecuritystandards.org/documents/Guidance-PCI-DSS-Scoping-and-Segmentation_v1_1.pdf, read 13 October 2026
  21. Self-Assessment Questionnaire D for Service Providers and Attestation of Compliance, for use with PCI DSS version 4.0, PCI Security Standards Council, April 2022, https://listings.pcisecuritystandards.org/documents/PCI-DSS-v4-0-SAQ-D-Service-Provider.pdf, read 13 October 2026

This guide explains the standard in general terms. It is not advice on your own compliance.

Normatiq does not perform PCI DSS assessments or issue Reports on Compliance. Your QSA does.

See it on your own case.

Ask for a walkthrough and we will show you the platform against a scope like yours.

Ask for a walkthrough

The button opens an email to info@normatiq.io.