PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/235 of 250
12.8.1Risk to information assets associated with third-party service provider (TPSP) relationships is managed
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
A list of all third-party service providers (TPSPs) with which account data is shared or that could affect the security of account data is maintained, including a description for each of the services provided.
Defined Approach Testing Procedures:
12.8.1.a Examine policies and procedures to verify that processes are defined to maintain a list of TPSPs, including a description for each of the services provided, for all TPSPs with whom account data is shared or that could affect the security of account data.
12.8.1.b Examine documentation to verify that a list of all TPSPs is maintained that includes a description of the services provided.