Map PCI responsibilities across cloud provider, platform team, and application owner.
The claim A cloud payment workload is assumed covered because the provider has a PCI AOC. Inherited controls and configured controls need different evidence. Responsibility mapping Inherit -> Configure -> Prove Use the provider AOC for provider-operated controls, then prove your own configuration and workload controls. Provider is compliant too broad clear evidence ownership You inherit provider controls; you own your configuration. 01 Provider 02 Customer 03 Shared Step 1 The assessor asks for data center physical security evidence for the managed database service.
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in