PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/238 of 250
12.8.4Risk to information assets associated with third-party service provider (TPSP) relationships is managed
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
A program is implemented to monitor TPSPs’ PCI DSS compliance status at least once every 12 months.
Defined Approach Testing Procedures:
12.8.4.a Examine policies and procedures to verify that processes are defined to monitor TPSPs’ PCI DSS compliance status at least once every 12 months.
12.8.4.b Examine documentation and interview responsible personnel to verify that the PCI DSS compliance status of each TPSP is monitored at least once every 12 months.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.