PCI DSS 3.2.1 Responsibility Matrix for SaaS Services

[mslavens]

I've been looking for any details from Palo Alto regarding the responsibility of controls for PCI 3.2.1 when it comes to SaaS and PaaS offerings such as Prisma Access, Wildfire, XSOAR, XDR, etc.  Most service providers will publish a 'responsibility matrix' that will define what the service provider is responsible for and what the consumer is.  Has anyone come across anything similar to this document (https://help.mypurecloud.com/articles/pci-dss-customer-responsibility-matrix/?) but for Palo Alto SaaS solutions?   

Many thanks!

[JayGolf]

Hi @mslavens ,

Does this work for you?

XDR - https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resour...

Strata - https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resour...

[mslavens]

Hi there,

Unfortunately not. We are specifically looking for a document that details what aspects of the SaaS solution Palo Alto is responsible for when it comes to meeting PCI guidelines and what parts are the responsibility of the consumer. For example – the infrastructure running the SaaS/PaaS offering is fully managed by Palo Alto so they would be responsible for securing it (OS, buildings etc), having a hardened standard, enforcing password policies, training the Palo Alto staff on security best practice etc. Whereas the consumer would be responsible for thing such as configuring the password policy within the consumer facing part of the solution, applying best practices, configuring and documenting integrations that consumed the SaaS/PaaS etc. Most vendors who offer SaaS and PaaS services that promote their products to help meet PCI compliance will also provide a ‘responsibility matrix’ to their consumer. Here is an example from a VOIP provider Genesys: https://help.mypurecloud.com/articles/pci-dss-customer-responsibility-matrix/

Thank you,

Michael