Should entities with enterprise or internal service providers, used to provide internal services to other corporate entities, conduct separate PCI DSS assessments of these service providers or include them as part of each corporate entity’s PCI DSS assessment?
Assessed entities have the discretion to either have enterprise functions assessed separately as an internal service provider or include those functions in each individual corporate entity’s PCI DSS assessment. Regardless of the entity’s decision, the appropriate validation tool for a service provider is either Self-Assessment Questionnaire (SAQ) D for Service Providers or a PCI DSS Report on Compliance (ROC), as directed by their compliance accepting entity (typically a merchant acquirer or a payment brand).