Should service providers demonstrate PCI DSS compliance as part of their client's assessment or in their own separate assessment?
There are two options for hosting providers and other third-party service providers to validate compliance:
1) Annual assessment: Service providers can undergo an annual PCI DSS assessment(s) on their own and provide evidence to their customers to demonstrate their compliance; or
2) Multiple, on-demand assessments: If they do not undergo their own annual PCI DSS assessments, service providers must undergo assessments upon request of their customers and/or participate in each of their customer?s PCI DSS reviews, with the results of each review provided to the respective customer(s).
For further details and guidance, refer to the Use of Third-Party Service Providers / Outsourcing section of the PCI DSS.