PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/241 of 250
12.9.2Third-party service providers (TPSPs) support their customers’ PCI DSS compliance
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
Additional requirement for service
providers only: TPSPs support their customers’
requests for information to meet Requirements
12.8.4 and 12.8.5 by providing the following upon customer request:
• PCI DSS compliance status information for any service the TPSP performs on behalf of customers (Requirement 12.8.4).
• Information about which PCI DSS requirements are the responsibility of the TPSP and which are the responsibility of the customer, including any shared responsibilities (Requirement 12.8.5).
Defined Approach Testing Procedures:
Additional testing procedure for service provider assessments only: Examine policies and procedures to verify processes are defined for the TPSPs to support customers’ request for information to meet Requirements 12.8.4 and 12.8.5 in accordance with all elements specified in this requirement.