Shared Hosting Provider
PCIComplianceHubLast updated
A provider that hosts multiple customer environments on shared infrastructure. Earlier versions of PCI DSS addressed these providers specifically in Appendix A1; v4.x broadened that appendix to cover multi-tenant service providers generally, reflecting the shift from traditional shared web hosting to cloud platforms. The underlying obligation is unchanged: one customer must not be able to reach another customer environment or data.
Applies to. PCI DSS v4.0.1 no longer uses this term in its requirements. The controls that applied to shared hosting providers now sit in Appendix A1 under the name multi-tenant service provider, which covers any provider hosting more than one customer on shared infrastructure, cloud platforms included. From the customer's side a shared hosting provider is a third-party service provider, so the customer's scope review must identify its connection to the CDE and Requirement 12 asks the customer to manage the relationship.
Limits. Appendix A1 binds the provider. The hosted customer's own assessment covers what the customer controls, and general practice is to agree in writing which requirements each side meets.
Related. Multi-Tenant Service Provider, Third-Party Service Provider, Service Provider, Cloud Computing, Responsibility Matrix
Sources. PCI DSS v4.0.1 (June 2024)