Should my Service Provider be PCI Compliant?

The short answer comes from the PCI Security Standards Council itself, in FAQ 1312: Requirement 12.8 does not say your third-party service providers must be PCI DSS compliant. It says you must manage them and monitor their compliance status. But any PCI DSS requirement a provider meets on your behalf is in scope for your assessment, so if the provider cannot show that requirement is met, it is not met for you either.

Whether a given provider has to undergo its own assessment is decided by the payment brands and acquirers, not by the standard.

Who counts as a third-party service provider

Any business outside your own that stores, processes or transmits account data for you, or could affect its security. Common ones:

• payment gateways and processors;
• hosting and cloud providers running your payment pages or systems, including multi-tenant platforms;
• managed security and IT providers with access to your environment;
• call centres that take card payments for you;
• companies that support or maintain your payment terminals or software.

What 12.8 asks of you

• A list. Every provider you share account data with, or that could affect its security, and what each one provides (12.8.1).
• A written agreement with each, in which the provider acknowledges responsibility for the account data it holds or handles for you, or to the extent it could affect its security (12.8.2).
• Due diligence before engaging a provider (12.8.3).
• Monitoring of each provider's PCI DSS compliance status at least once every 12 months (12.8.4).
• A record of who does what: which requirements each provider manages, which you manage, and which are shared (12.8.5). A responsibility matrix is the usual way to keep it.

What to ask a provider for

FAQ 1576 sets out what a provider is expected to give its customers. If it has been assessed, it provides its Attestation of Compliance (AOC) on request, and the AOC should cover the services it provides to you. You can also ask for the relevant sections of its Report on Compliance or SAQ D for Service Providers. If it has not been assessed, it is expected to provide specific evidence for the requirements it meets for you, so that you or your assessor can confirm them.

Check the AOC against the service you actually buy. An AOC for a provider's hosting platform says nothing about the managed firewall service it also sells you unless that service was in the assessment's scope.

Where a provider has a current assessment covering the service, your own assessor does not have to visit the provider and retest those requirements (FAQ 1290).

What the standard asks of the provider

Two requirements apply to service providers specifically in their dealings with customers:

• 12.9.1: give customers written agreements acknowledging responsibility for the account data the provider handles for them, or to the extent it could affect its security.
• 12.9.2: on request, give customers their PCI DSS compliance status and which requirements are the provider's, which the customer's, and which are shared.

Service providers also carry a set of requirements merchants do not, among them a documented cryptographic architecture (3.6.1.1), unique authentication factors for each customer's premises when they have remote access (8.2.3), penetration tests of segmentation every six months rather than every twelve (11.4.6), executive responsibility for a PCI DSS compliance programme (12.4.1), and scope confirmation every six months (12.5.2.1). Multi-tenant providers must also support their customers' external penetration testing (11.4.7).

Using a compliant provider does not make you compliant

A provider's AOC covers the provider. Your own compliance still depends on the requirements you keep: how your systems connect to the provider, who in your business can reach account data, and the 12.8 oversight above. Choosing an outsourced model can shrink what you keep, sometimes to a short SAQ, but only if it is set up the way that SAQ's eligibility criteria describe.

When a provider's AOC is getting old at the time of your own assessment, What happens if your third-party service provider's AOC is nearly a year old? covers what the Council says.