PCI DSS v4.0.1
The current PCI DSS baseline for protecting account data. Requirement 12.8 addresses management of third-party service-provider relationships, including due diligence, agreements, clear responsibility allocation, a maintained provider list, and at least annual monitoring of provider compliance status.
What the authority establishes
The current PCI DSS baseline for protecting account data. Requirement 12.8 addresses management of third-party service-provider relationships, including due diligence, agreements, clear responsibility allocation, a maintained provider list, and at least annual monitoring of provider compliance status.
Outsourcing payment functions does not eliminate the customer's oversight responsibility. Buyers need an accurate service-provider inventory, documented responsibility matrices, evidence of due diligence, contract terms, scoped control ownership, and recurring compliance-status monitoring.
The record is written for operational interpretation, not legal advice. Applicability depends on entity type, jurisdiction, relationship, service, data, criticality, contractual commitments, and later authority guidance.
Who should read it
The primary audiences named in this review are merchants, processors, acquirers, issuers, and payment service providers, payment-security and PCI compliance teams, procurement, legal, cybersecurity, and third-party risk teams, third-party service providers supporting cardholder-data environments. Those roles may divide responsibility differently, but the operating record should still show scope, accountable ownership, evidence, review, exceptions, and the final decision.
Third-party lifecycle implications
Scope And Inventory
Teams should determine what this authority expects at the scope and inventory stage, which function owns the judgment, what evidence must be retained, and what later change would reopen the record.
Due Diligence
Teams should determine what this authority expects at the due diligence stage, which function owns the judgment, what evidence must be retained, and what later change would reopen the record.
Contracting
Teams should determine what this authority expects at the contracting stage, which function owns the judgment, what evidence must be retained, and what later change would reopen the record.
Responsibility Allocation
Teams should determine what this authority expects at the responsibility allocation stage, which function owns the judgment, what evidence must be retained, and what later change would reopen the record.
Annual Compliance Monitoring
Teams should determine what this authority expects at the annual compliance monitoring stage, which function owns the judgment, what evidence must be retained, and what later change would reopen the record.
Relationship Change And Termination
Teams should determine what this authority expects at the relationship change and termination stage, which function owns the judgment, what evidence must be retained, and what later change would reopen the record.
Capabilities that may support the work
These links identify relevant operating capabilities; they do not state that any product creates compliance.
Intake And Inventory
establishing an accountable record of relationships, products, owners, and critical services. Buyers should test the workflow against their own scope and evidence requirements.
Inherent Risk Tiering
using relationship context to determine proportional diligence and review. Buyers should test the workflow against their own scope and evidence requirements.
Due Diligence And Assessments
collecting and reviewing evidence before and during a relationship. Buyers should test the workflow against their own scope and evidence requirements.
Evidence Collection
preserving source material, responses, and reviewer context. Buyers should test the workflow against their own scope and evidence requirements.
Continuous Monitoring
bringing material external and internal change into an owned response workflow. Buyers should test the workflow against their own scope and evidence requirements.
Issue Remediation
assigning findings, deadlines, exceptions, and closure evidence. Buyers should test the workflow against their own scope and evidence requirements.
Regulatory Mapping
connecting program records to obligations and examination needs. Buyers should test the workflow against their own scope and evidence requirements.
Reporting
turning program activity into operator, executive, and board-ready information. Buyers should test the workflow against their own scope and evidence requirements.
Offboarding
closing access, data, evidence, and residual obligations when a relationship ends. Buyers should test the workflow against their own scope and evidence requirements.
What software cannot decide
Software can structure records, route work, preserve evidence, surface change, and support reporting. It cannot determine legal applicability, set risk appetite, negotiate accountable contract terms, validate every external claim, accept residual risk, or make management responsible for an outcome. Those remain organizational decisions.