Which statement best reflects the requirement for managing service providers under PCI DSS (Req 12.8)?

Which statement best reflects the requirement for managing service providers under PCI DSS (Req 12.8)?

• A. No formal process
• B. Only sign a contract
• C. Maintain a list of service providers
• D. Maintain and implement policies and procedures to manage service providers with whom cardholder data is shared, or that could affect the security of cardholder data

Answer: (D)

Managing service providers under PCI DSS requires a formal, ongoing process to govern any third party that handles cardholder data or could affect its security. The best statement reflects that you must both maintain and implement policies and procedures specifically to manage these providers, covering those with whom cardholder data is shared or whose activities could impact security. This isn’t satisfied by simply signing a contract, keeping a list, or having no formal process. A robust approach includes due diligence before engaging a provider, clear security requirements in written agreements, ongoing oversight of the provider’s security practices, monitoring for compliance, and provisions for managing sub-service providers and incidents. The emphasis is on governance and continuous protection, not just one-off actions.

Managing service providers under PCI DSS requires a formal, ongoing process to govern any third party that handles cardholder data or could affect its security. The best statement reflects that you must both maintain and implement policies and procedures specifically to manage these providers, covering those with whom cardholder data is shared or whose activities could impact security.

This isn’t satisfied by simply signing a contract, keeping a list, or having no formal process. A robust approach includes due diligence before engaging a provider, clear security requirements in written agreements, ongoing oversight of the provider’s security practices, monitoring for compliance, and provisions for managing sub-service providers and incidents. The emphasis is on governance and continuous protection, not just one-off actions.