PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/237 of 250
12.8.3Risk to information assets associated with third-party service provider (TPSP) relationships is managed
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
An established process is implemented for engaging TPSPs, including proper due diligence prior to engagement.
Defined Approach Testing Procedures:
12.8.3.a Examine policies and procedures to verify that processes are defined for engaging TPSPs, including proper due diligence prior to engagement.
12.8.3.b Examine evidence and interview responsible personnel to verify the process for engaging TPSPs includes proper due diligence prior to engagement.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.