PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/240 of 250
12.9.1Third-party service providers (TPSPs) support their customers’ PCI DSS compliance
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
Additional requirement for service providers only: TPSPs acknowledge in writing to customers that they are responsible for the security of account data the TPSP possesses or otherwise stores, processes, or transmits on behalf of the customer, or to the extent that they could impact the security of the customer’s CDE.
Defined Approach Testing Procedures:
12.9.1 Additional testing procedure for service provider assessments only: Examine TPSP policies, procedures, and templates used for written agreements to verify processes are defined for the TPSP to provide written acknowledgments to customers in accordance with all elements specified in this requirement.