Guide
Building a PCI responsibility matrix
A PCI responsibility matrix shows, requirement by requirement, what you own and what each provider owns. Requirement 12.8 expects you to know this, so the QSA usually asks for it.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
Why a PCI responsibility matrix matters
Hosting, payment pages and support tools often sit with providers. So some requirements are met by them, some by you and some by both. Without a matrix, gaps hide in the shared lines.
Also 12.8 asks you to keep a provider list, written agreements and a record of which requirements each provider covers.
What a PCI responsibility matrix looks like
Keep it simple: one row per requirement, one column per provider. Then mark each cell.
| Requirement area | You | Hosting provider | Payment page provider |
|---|---|---|---|
| Network controls | Shared | Shared | No |
| Payment page scripts | Yes | No | Shared |
| Access for your staff | Yes | No | No |
| Physical security | No | Yes | Yes |
| Logging | Shared | Shared | Shared |
PCI responsibility matrix check
Tick what your vendor file holds.
Your result appears here as you tick, so you can see what is still open.
Getting the provider's side
Ask each provider for its own matrix and its AOC. Many publish both. Then compare their matrix with yours.
Because providers describe responsibilities in their own terms, translate them into requirement numbers.
Keeping the PCI responsibility matrix current
Review it each year and whenever a provider changes. Also check new AOCs as they arrive. As a result, the matrix stays a working document.
In addition, record who reviewed it and when.
Shared responsibilities
Shared cells need extra care. So write what each party does, in a sentence. For example, the provider maintains the firewall, while you approve rule changes.
Then the QSA can test your half clearly.
Where Ashcroft helps
We build the matrix, collect provider documents and set the yearly review. Our gap analysis fee runs $8,000 to $40,000. We are not a QSA. The standard is in the PCI SSC document library.
Also check contracts against the matrix. Because 12.8 expects written agreements, the contract should say what the provider covers. So legal and compliance review them together. In addition, flag any provider that will not confirm its share in writing.
PCI responsibility matrix questions
Is a PCI responsibility matrix required?
Requirement 12.8 expects you to know who covers what. A matrix is the usual way.
Who writes the PCI responsibility matrix?
You do, using each provider's own documents.
How often should the PCI responsibility matrix change?
At least yearly, and when providers change.
Does the provider's AOC replace it?
No. The AOC shows their compliance. The matrix shows the split.
Related guides
Build your PCI responsibility matrix
List your payment and hosting providers. We reply with a written estimate, usually inside one business day.
Get my written estimate