Compliance

Applies to. PCI DSS v4.0.1 treats compliance as something to be maintained and evidenced between assessments, not a one-off result. Service providers must have executive-owned responsibility for a PCI DSS compliance programme with a charter (12.4.1) and must document the reviews that show controls are being performed, with sign-off by whoever runs that programme (12.4.2.1). Every entity must monitor the PCI DSS compliance status of its third-party service providers at least once every 12 months (12.8.4), service providers must supply that status and a split of responsibilities on request (12.9.2), and the annual technology review must confirm that technologies in use still support compliance (12.3.4).

Limits. Compliance is assessed at a point in time and reported in a ROC or SAQ with an Attestation of Compliance; the requirements above are about keeping it in place between assessments, not about the assessment itself.