12.9 TPSPs support their customers’ compliance
How to meet it
If you are a TPSP, acknowledge responsibility and provide evidence to customers.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 12.9, in plain English.
12.9.1Service providers give customers written acknowledgment of responsibility for account data security.
12.9.2Service providers support customer requests for compliance status and responsibility information.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Incident response policyUse for ISO 27001 A.5.24 to A.5.28, SOC 2 incident response, PCI DSS 12.10, and security event handling.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Cloud services and outsourcing policyUse for ISO 27001 A.5.19 to A.5.23, SOC 2 vendor management, and oversight of cloud and outsourced service providers.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.
Open the control-to-policy map← 12.8 Third-party service provider (TPSP) risk is managed12.10 Suspected and confirmed incidents are responded to →
Back to Requirement 12, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.