Trusted Third Party (TTP)

Applies to. PCI DSS v4.0.1 does not use the term trusted third party in its requirements. Where an outside organisation performs a trust function for an entity, the standard sees it as one of two things: a third-party service provider, managed under Requirement 12 and identified in the scope review where it has a connection to the CDE, or a source of trust the entity relies on inside a control, such as the trusted keys and certificates that Requirement 4 says are the only ones accepted when PAN crosses open, public networks.

Limits. Calling a party trusted does not take it out of scope; a key management or certificate service that touches account data or can affect the CDE is a third-party service provider like any other.