SaaS (Software as a Service)

Applies to. PCI DSS v4.0.1 does not name SaaS in its requirements. A SaaS provider that stores, processes or transmits account data for a customer, or that could affect the security of the customer's CDE, is a third-party service provider: the customer's scope review must identify the provider's connection to the CDE and confirm it is in scope, and Requirement 12 asks the customer to manage the provider relationship. A provider serving many customers on shared infrastructure is also a multi-tenant service provider with its own obligations under Appendix A1.

Limits. Using a SaaS provider does not move the obligation. The customer stays responsible for its own compliance and for confirming which requirements the provider covers; general practice is to get that split in writing.