PCI DSS Compliance – Meeting the Third-Party Vendor Requirements

Essentially, PCI DSS compliance has six primary objectives, which include the following:

• Build and maintain a secure network and systems.
• Protect account data.
• Maintain a vulnerability management program.
• Implement strong access control measures.
• Regularly monitor and test networks.
• Maintain an information security policy.

A list of all third-party service providers (TPSPs) with which account data is shared or that could affect the security of account data is maintained, including a description for each of the services provided.

As the requirement suggests, merchants are required to keep an updated list of all the companies they deem as service providers, such as payment processors, anti-malware services, web hosting service providers, IT services, and with whom account data is shared. The list will also be used for other assessments and PCI 12.8 requirements.

The list provides a great way for merchants to evaluate and monitor all the service providers who may have access to account data or the CDE. The list may further allow the merchants to assess the security posture and determine the level of risks associated with the cardholder data.

Written agreements are maintained with all TPSPs with which account data is shared, or that could affect the security of the CDE. Written agreements include acknowledgments from TPSPs that they are responsible for the security of account data the TPSPs possess or otherwise store, process, or transmit on behalf of the entity or to the extent that they could impact the security of the entity’s CDE.

The sub-requirement mainly focuses on the relationship between the merchant and the service provider. It gives a detailed description acknowledging that the service provider will be liable for the security of cardholder data shared by the merchant. The contract between the parties acts as evidence, displaying the commitment of the service provider to protecting the data. Here, it is further important to note that the written agreement isn’t the same as PCI DSS Attestation of Compliance (AOC).

The written agreement acknowledges that the TPSP will maintain proper security controls for data protection. The entity may also want to understand whether the TPSP relies on a secondary TPSP for data processing. Hence, the agreement should inform the entity about any “nested” relationship with a secondary TPSP.

An established process is implemented for engaging TPSPs, including proper due diligence prior to engagement.

The sub-requirement involves a thorough risk analysis of the service provider. The analysis should be conducted before establishing a formal relationship with the service provider or closing an agreement. The process involves “proper due diligence.” It is no surprise that most organizations still don’t understand the meaning and context of due diligence. The conduct includes analyzing various components and aspects of the service provider to ensure that the service indeed does what it says. These critical assessments can be carried out by sharing a questionnaire with the service provider or via a site visit. These assessments are usually conducted annually for newer projects or agreements, but exceptions can be made for sensitive agreements.

A program is implemented to monitor TPSPs’ PCI DSS compliance status at least once every 12 months.

The sub-requirement is aimed at the merchant as they are liable for monitoring the PCI DSS compliance status of all the third-party vendors they are engaged with. The sub-requirement is more like an assurance for the merchant, providing them the relief that the service provider is compliant with PCI DSS. The merchant should inquire about the compliance status of the service provider at least annually. It is the responsibility of the service provider to undergo its own assessment and obtain an Attestation of Compliance (AOC). The Standard also allows for a variance of this requirement:

“If the TPSP did not undergo a PCI DSS assessment, it may be able to provide other sufficient evidence to demonstrate that it has met the applicable requirements without undergoing a formal compliance validation.”

Information is maintained about which PCI DSS requirements are managed by each TPSP, which are managed by the entity, and any that are shared between the TPSP and the entity.

When the PCI DSS compliance requirements bind the merchant, they won’t have to wonder about the compliance of their service providers. It is imperative for merchants to have a streamlined process in place to identify and catalog all their service providers, assess their risks, and ensure their compliance status with PCI DSS. This will protect the business and, most importantly, the customers.

About the Author:

With a strong background in the SaaS and IaaS industry, Syed Sayem Mustufa has extensive experience in Marketing. Over the years, Sayem has served some of the top data intelligence and cybersecurity brands, including Securiti.ai. He loves nothing more than breaking down and simplifying highly complex product details into easy-to-understand benefits for end users.

Editor’s Note: The opinions expressed in this and other guest author articles are solely those of the contributor and do not necessarily reflect those of Tripwire.