12.8 Third-party service provider (TPSP) risk is managed
How to meet it
Maintain a TPSP list, define responsibilities, and monitor their compliance.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 12.8, in plain English.
12.8.1A list of all third-party service providers that share or could affect account data is maintained, with services described.
12.8.2Written agreements with TPSPs include their acknowledgment of responsibility for account data security.
12.8.3A process for engaging TPSPs includes proper due diligence before engagement.
12.8.4A program monitors TPSP PCI DSS compliance status at least every 12 months.
12.8.5Information is kept on which requirements are managed by each TPSP, the entity, or shared.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Cloud services and outsourcing policyUse for ISO 27001 A.5.19 to A.5.23, SOC 2 vendor management, and oversight of cloud and outsourced service providers.Information security roles and responsibilitiesUse for ISO 27001 A.5.2, A.5.3 and A.5.4, defining security roles, segregation of duties, management responsibilities, and SOC 2 organisational controls.Supplier security policyUse for ISO 27001 A.5.19 to A.5.23, SOC 2 vendor management, cloud services, and AI supplier reviews.
Open the control-to-policy mapBack to Requirement 12, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.