Which document details the additional PCI DSS requirements for Shared Hosting Providers?

Which document details the additional PCI DSS requirements for Shared Hosting Providers?

• A. Appendix B: Network Segmentation Guidelines.
• B. Appendix C: Audit Procedures for Vendors.
• C. Appendix A: Additional PCI DSS Requirements for Shared Hosting Providers.
• D. Appendix D: Data Minimization Techniques.

Answer: (C)

In PCI DSS guidance, special situations have their own dedicated appendices, and for shared hosting setups there are extra requirements outlined in a document titled with “Additional PCI DSS Requirements for Shared Hosting Providers.” This appendix is the only one that explicitly defines what hosting providers must add or adjust beyond the standard PCI DSS rules to protect cardholder data when multiple merchants’ data share the same infrastructure. It clarifies how responsibilities are split between the provider and customers, and it covers necessary controls around segmentation, access, and monitoring to prevent cross-merchant data exposure. The other documents describe general topics like network segmentation guidelines, audit procedures for vendors, or data minimization techniques, but they do not specify the shared hosting provider’s extra obligations.

In PCI DSS guidance, special situations have their own dedicated appendices, and for shared hosting setups there are extra requirements outlined in a document titled with “Additional PCI DSS Requirements for Shared Hosting Providers.” This appendix is the only one that explicitly defines what hosting providers must add or adjust beyond the standard PCI DSS rules to protect cardholder data when multiple merchants’ data share the same infrastructure. It clarifies how responsibilities are split between the provider and customers, and it covers necessary controls around segmentation, access, and monitoring to prevent cross-merchant data exposure. The other documents describe general topics like network segmentation guidelines, audit procedures for vendors, or data minimization techniques, but they do not specify the shared hosting provider’s extra obligations.