The PCI sub-requirements and testing procedures 12.8-12.84 concern the relationship between merchants and their service providers, including PCI compliant hosting providers.
These sub-requirements fall under the main requirement #12: Maintain an Information Security Policy – meaning that a merchant must maintain a policy that addresses information security for all personnel, including internal employees, contractors and consultants. The sub-requirements 12.8-12.84 include language that specifically refers to service providers.
According to Verizon’s 2011 PCI Compliance Report (PDF), this is one of the most difficult PCI DSS requirements for most organizations to achieve, with only 39 percent of merchants at full achievement.
12.8 – If cardholder data is shared with service providers[backup tape storage or managed service providers, or those that use the data for fraud modeling purposes], you must maintain and implement policies and procedures to manage server providers.
How do you test it? You can test it by observing, reviewing policies and procedures, and reviewing supporting documentation for the rest of the requirements.
According to , this is one of the most difficult PCI DSS requirements for most organizations to achieve, with only 39% of merchants at full achievement. Here are the requirements you need to pay attention to and how to document/test them:
12.8.1 – Maintain a list of service partners.
How do you test it? Pretty self-explanatory; keep a current and comprehensive list of vendors and verify that it is updated whenever you sign with a new provider or end Managed Cyber Security a contract. It’s also good practice to keep tabs on your current service partners’ audit types and dates for your own verification of ongoing compliance.
12.8.2 – Maintain a written agreement that includes an acknowledgement that the service providers are responsible for the security of cardholder data they possess.
How do you test it? Check within your contract for specific language around the roles and responsibilities of your service providers when it comes to securing cardholder data. For example, if there’s a known data breach of your server, what’s the timeframe and process in which the service provider should notify you? And how long should data be retained after your contract expires, and how should it be deleted? And, more importantly, who has ownership or rights to your data?
12.8.3 – Ensure there is an established process for engaging service providers including proper due diligence prior to engagement.
How do you test it? Create a document with policies and procedures around how you qualify a vendor’s ability to provide a secure PCI compliant data center and services. Ensure you do your homework to save yourself a headache later – check their PCI audit report for the full scope of their compliance and compare it to what you still need to cover.
12.8.4 – Maintain a program to monitor service providers’ PCI DSS compliance status at least annually.
How do you test it? Establish a way internally to verify your service provider’s ongoing PCI compliance status each year. You could assign a point of contact to exemplify their due diligence in analyzing their audit reports or perhaps keep in touch with your service provider’s security officer to verify dates and details of compliance.
By following these guidelines and ensuring you achieve all of these sub-requirements you’ll be able to ensure that your company, and your service partners, are completely PCI compliant.