PCI DSS 3.2.1 Responsibility Matrix for SaaS Services

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

PCI DSS 3.2.1 Responsibility Matrix for SaaS Services

L1 Bithead

I've been looking for any details from Palo Alto regarding the responsibility of controls for PCI 3.2.1 when it comes to SaaS and PaaS offerings such as Prisma Access, Wildfire, XSOAR, XDR, etc.  Most service providers will publish a 'responsibility matrix' that will define what the service provider is responsible for and what the consumer is.  Has anyone come across anything similar to this document (https://help.mypurecloud.com/articles/pci-dss-customer-responsibility-matrix/?) but for Palo Alto SaaS solutions?   

Many thanks!




Community Team Member

Hi @mslavens ,


Does this work for you?


XDR - https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resour...

Strata - https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resour...


LIVEcommunity team member
Stay Secure,
Don't forget to Like items if a post is helpful to you!

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Hi there,

Unfortunately not. We are specifically looking for a document that details what aspects of the SaaS solution Palo Alto is responsible for when it comes to meeting PCI guidelines and what parts are the responsibility of the consumer. For example – the infrastructure running the SaaS/PaaS offering is fully managed by Palo Alto so they would be responsible for securing it (OS, buildings etc), having a hardened standard, enforcing password policies, training the Palo Alto staff on security best practice etc. Whereas the consumer would be responsible for thing such as configuring the password policy within the consumer facing part of the solution, applying best practices, configuring and documenting integrations that consumed the SaaS/PaaS etc. Most vendors who offer SaaS and PaaS services that promote their products to help meet PCI compliance will also provide a ‘responsibility matrix’ to their consumer. Here is an example from a VOIP provider Genesys: https://help.mypurecloud.com/articles/pci-dss-customer-responsibility-matrix/

Thank you,

  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!