Outsourcing
PCIComplianceHubLast updated
The practice of contracting with a third-party organization to provide services or perform tasks that would otherwise be done in-house. When outsourcing services related to cardholder data or the cardholder data environment, it is crucial to ensure that third-party providers are PCI DSS compliant and have adequate security measures in place.
Applies to. PCI DSS v4.0.1 says third-party service provider rather than outsourcing. Requirement 12 covers how an entity manages the providers it shares account data with or that could affect the security of its CDE, and the entity's scope review must identify every connection from third parties with access to the CDE and confirm those connections are in scope. General practice under that requirement is a written agreement with each provider and a record of which PCI DSS requirements each side meets.
Limits. Outsourcing a function does not outsource the obligation. The entity stays responsible for its own compliance, and where it relies on a provider for a requirement it needs evidence that the provider meets it.
Related. Third-Party Service Provider, Service Provider, Responsibility Matrix, SaaS (Software as a Service), Multi-Tenant Service Provider
Sources. PCI DSS v4.0.1 (June 2024)