IBM Cloud completed the annual Payment Card Industry Data Security Standard PCI DSS assessment using an approved Qualified Security Assessor (QSA), and the resulting Attestation of Compliance (AOC) and Service Responsibility Matrix (SRM) guide is available upon client request.
Organizations looking to store, transmit or process cardholder data can use IBM Cloud services that have been assessed for PCI DSS compliance. A broad set of IBM Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) offerings have also been assessed for PCI DSS, as detailed on IBM.com.
Clients may leverage IBM Cloud services in a shared responsibility model to store, process and transmit cardholder data and use these services to create cardholder data environments (CDEs). Clients may request and use the IBM Cloud AOCs and SRM guides when seeking to develop these application environments and obtain their own PCI DSS certifications. It is the responsibility of the client to document and operate CDEs and applications built using IBM Cloud services in a PCI DSS-compliant manner.
The QSA reviewed the in-scope IBM Virtual Private Cloud (VPC) services for compliance under PCI DSS version 3.2.1 as a Level 1 Service Provider. Adding to the compliant IBM Cloud IaaS, PaaS and VPC services previously assessed under the PCI DSS are the following: