PCI SSC Publishes New Guidance on Understanding PCI DSS Third-Party Service Providers
The PCI Security Standards Council (PCI SSC) has released a new information supplement, Understanding PCI DSS Service Providers, to help merchants, service providers, assessors, and acquirers understand PCI DSS requirements and expectations for relationships between customers and third-party service providers (TPSPs). The Council developed this guidance in partnership with the PCI SSC Board of Advisors and Global Executive Assessor Roundtable (GEAR) and in response to questions received about TPSP relationships.
Highlights of the guidance include:
- Explaining related PCI DSS Requirements – A customer using TPSPs has to manage and monitor them in accordance with Requirement 12.8. This requirement specifies maintaining lists of TPSPs, having written agreements with them, performing due diligence before engagement, monitoring TPSPs’ PCI DSS compliance status at least once every 12 months, and recording which PCI DSS requirements are managed by a TPSP, which are managed by the customer, and any shared requirements. In addition, Requirement 12.9 specifies that a TPSP acknowledges its responsibility to customers in writing and supports its customers’ requests for information. Requirements 12.8 and 12.9 are designed to work together.
- Clarifying expected evidence – When a TPSP meets one or more PCI DSS requirements for customers or can impact the security of a customer’s environment, the TPSP is expected to provide its customers evidence that the TPSP meets the PCI DSS requirements applicable to its service.
- Defining “Impact Security” – This term applies to those TPSPs with services that operate within customer environments, for example managed network services, remote administration, hosting, or backup services. The guidance gives examples of services that can impact security and services that generally do not.
- Determining who is a TPSP – A decision flow for readers to walk through to help determine whether a given provider is a TPSP.
- Distinguishing Multi-Tenant Service Providers and Nested Service Providers – The guidance explains what distinguishes a multi-tenant service provider and how administrative control is the deciding factor, defines a nested TPSP and explains how responsibility flows when there are nested TPSPs.
- Outlining the TPSP Management Lifecycle – Sets out seven steps, including identifying TPSPs, determining which services can impact the security of the customer environment, documenting how responsibilities are allocated, and monitoring TPSPs’ PCI DSS compliance status.
- Identifying Customer and TPSP Responsibilities – Includes examples of how responsibilities can be split between a customer and a TPSP, and details about the TPSP’s Attestation of Compliance (AOC).
The guidance also includes answers to Frequently Asked Questions (FAQs) and an Appendix that summarizes the PCI DSS v4.x requirements that apply only to service providers.
This information supplement does not replace or supersede requirements in any PCI SSC standard. Organizations with questions about their own compliance obligations should contact their acquirer, payment brand, or the organization that manages their compliance program.
Understanding PCI DSS Service Providers is now available in the PCI SSC Document Library.
About Author
