PCI SSCPCI DSSScoping SegmentationEASYFree question
When does a third-party service provider's environment become part of the organization's PCI DSS scope?
- A.When the provider hosts the organization's marketing website, email, or file shares in the same data center campus alongside payment systems
- B.When the contract exceeds one million dollars in annual value, covers payment applications, or lasts longer than three years under a single master agreement
- C.When the provider stores, processes, or transmits cardholder data on the organization's behalf or could impact CDE security
- D.When the provider holds a Level 1 AOC, signs the NDA, or appears on the card brand listing
Why C is correct
Service providers that handle cardholder data or could impact CDE security are part of the organization's PCI DSS scope, though they may validate their own compliance separately.
Know someone studying for PCI DSS? Send them this one.