PCI SSCPCI DSSSecurity PolicyEASYFree question
What does PCI DSS require regarding third-party service providers?
- A.Organizations must obtain an annual certificate from each service provider, reject providers without a registry listing, and accept the provider's marketing statements on compliance
- B.Organizations must maintain a list of service providers, monitor their PCI DSS compliance, and have written agreements defining security responsibilities
- C.Organizations must rank service providers by transaction volume, require a report on compliance from the largest ones, and leave smaller providers unmonitored
- D.Organizations must keep a signed NDA, collect an invoice, and file the provider's security brochure each year
Why B is correct
PCI DSS requires maintaining a service provider inventory, monitoring their compliance status, and having written agreements defining each party's security responsibilities.
Know someone studying for PCI DSS? Send them this one.