[Autogenerated] in this module.
We're just going to look at the two requirements that deal with third parties
or as PC IDE CSS lights to call them service providers.
Because there's organizations outsource more and more
of their I t and their payments,
they have less and less control over the security of
those outsourced systems and services.
But as far as PC IDE CSS is concerned,
they always maintain responsibility for the security of cardholder data.
The basic request of Requirement 12.8 is that organizations properly
managed third-party service providers by having a set of policies and
procedures to make sure there's a robust processes in place about how
service providers error engaged on managed.
I guess the first thing to understand is what PC IDE
CSS defines a service provided to be.
There are two classes of organizations.
The first is organizations that receive cardholder data.
So organizations I think it says that you share cardholder data with them.
I don't like that word share,
but organizations that receive cardholder data on the second is any
organization that can affect the security of cardholder data,
such as a hosting provider or or a manage security service provider or on
outsourced I t provider on before we dive into what policies and procedures
need to be in place to do with service providers.
Here's something that's not really well defined,
and it can catch non commercial.
QoS is out because they take a too literal approach to this requirement,
particularly that word share.
So let's make sure we're clear about who is a service provider.
And I can best describe this really simple picture because the best
definition there is of a service provider is also simple.
It's someone you pay to do something for you,
something that's related to the security off cardholder data or
related to the cardholder data you're responsible for.
Actually,
if you're in the EU and subject to the GDP are a service
providers basic the same as a data process?
Er, look at this picture.
We've got the organization being assessed for compliance with PC IDE CSS.
That's one in orange with the letter A,
and they've bought a service from a second organization here.
I've put it in Sion with the Letter B organization A is going to
be the customer or purchaser on Organization B.
Is the supplier or vendor typically organization a sense
cardholder today still Organization B and ask them to do
something with it on their behalf.
Commercially organization be Will invoice organization A an
organization A Will pay organization be so the the entity that sending
an invoice and being paid is the service provider.
The one exception to this general rule is that if you're a merchant,
your merchant or requiring bank is not a service provider,
and this is confirmed in F a.
Q 1284 That's of course,
unless the acquirer or merchant bank is providing
other services to the merchants,
such as a payment gateway or car to organization,
in which case there is service provider for those functions.
There's also one error that I seek uses,
and merchants and service providers get confused by because
sometimes it's not unknown for the service provider to send
cardholder data to emergent.
For example,
the merchant might have asked the service provided to
collect the cardholder data on its behalf before it sends
it to the merchant for processing.
Now, some QoS is follow the flow of cardholder data on.
They argue that in this example,
organization bees sharing cardholder data with organization a they
try to say that Azure service provided to be on.
That's wrong because A is still contracting or buying a service from B Azure,
ultimately responsible for the security of cardholder data.
So if if you ever get stuck,
working out who was service provider is my best advice,
I get is again to always look a who pays who but isn't a
specific testing procedure for 12.8 itself.
It's one of those that refer to the testing requirements.
But all the sub requirements and the general approach actually to all of 12.8,
is to look at documentation.
The first, some requirement, 12.8 point one,
is pretty simple on once the organization to keep a list of service providers,
which also includes a description of the service they provide.
Now,
I tend to advise people to also make sure they list the type in the
volume of cardholder data the service provider receives or has
access do on the contact details of the security and compliance
contact with the service provider,
and also when their PC IDE CSS compliance expires.
The test for this is pretty simple.
The QoS is just going to check the list and make sure it
exists on has the information in it.
The next of requirement is a very beautiful fudge because in a non ideal world,
it would say have a contract with the service provider that
compels them to comply with PC IDE CSS.
But it doesn't.
It saves.
There needs to be a written agreement between the
service provider on the merchants.
This written agreement, which may or may not be a contract,
needs to include an acknowledgement from the service provider that
the service provider has responsibility for the security of the
cardholder data they process on your behalf or that they can affect
the security of cardholder data.
Now how this responsibility is word it is completely up to
you or more probably up to your lawyer.
What's important is that you have something in writing that shows
the service provider has confirmed that they know those
cardholder data involved in this service.
PC IDE CSS isn't any more specific than this.
It isn't looking to specify Contract clauses is not looking to
specify specific conduct from the service provider,
and it isn't looking to pass liability in the event of a
data breach of the service provider,
although I hope your lawyers do all of these things.
But PC Idea says,
Just wants to make sure that the service provider has acknowledged its
responsibility for the security of cardholder data on the QoS.
A.
Will want to check that written agreement now,
given this written agreements,
often buried somewhere in a long and quite commercially sensitive contract,
Sometimes it's worth getting this information together
before an assessor wants to see it.
Personally,
I keep copies of the relevant pages of the contract with this
acknowledgment of responsibility with my list of service providers.
The next service provider sub requirement is that the
organization must have a due diligence process.
It follows when engaging a service provider and,
as the guidance says, this will typically include a risk analysis,
some understanding of how the service provided demonstrates
its compliance with the PC IDE CSS requirements and how the
service provider managers incidents.
The use A will want to see the policies or procedures that specify
what type of due diligence the organization has determined is
required to be undertaken before a service.
Providers engaged and the QoS a will also want to see the
evidence that these procedures were followed,
that the due diligence happened for the service providers that are
listed in requirement 12.8 point one requirement,
12.8 point four is pretty simple and wants to make sure
that the organization checks the compliance status of
each service provider annually.
So that's typically by getting a new version of the service
providers at a station of PC IDE CSS compliance on also making
sure that it still applies to the services that are provided to
the organization and QoS.
A will look to see that this is a policy, but also that is carried out no.
Before we get to the last sub requirement dealing with service providers,
I guess I need to answer the question that you're probably asking yourself,
which is whether a service provider needs to comply with PC IDE
CSS because we've not actually explicitly had that stated in
requirement 12.8 on the answer is, well,
sort off.
If an organization has an obligation to comply with PC IDE CSS,
then even if it outsources things to one or more service providers,
API GUID CSS still applies to the people processes and
technology provided by the service providers,
so the organization has a couple of options.
The first is to ask the service provider to provide evidence of its own
compliance with PC IDE CSS by providing its own at a station of PC IDE CSS
compliance that will have Bean produced either by its internal assessor or
by a qualified security assessor on.
It's important that that at a station covers the services being
provided to the organization OAuth the organization or,
more normally, the organization's QoS Azure I can.
GOAN ASSESS The service providers compliance with the PC IDE CSS
requirements as part of its own assessment,
So York Yusa would go to your service provider on
assess or the requirements for in place.
So the full answer to the question is that the people process
and technology provided by the service provider do need to
comply with the PC IDE CSS requirements.
And that's what sub requirement 12.8 point five tries to make clear,
because it demands that you define exactly what PC IDE AD FS requirements are
the responsibility of the organization on which requirements of the
responsibility of the service provider and the best way of doing This is to
create what we all call a responsibility matrix,
listing all 300 PC IDE CSS requirements and sub requirements and saying who,
whether it's the organization or the service provider who does what
for the services offered a typical responsibility.
Matrix looks something like this.
It's a spreadsheet with all the PC IDE CSS requirements listed down the
left hand side and then columns showing whether requirement applies to the
organization or the service provider or if it's a shared responsibility to
validate this requirements in place,
the QoS is going to want to see something that shows which
requirements the responsibility of each party,
which is why everyone uses something that looks like that responsibility matrix.
That's the end of requirement 12.8,
which details were organizations have to fulfill when
they deal with service providers.
The general guidance about how you deal with third-party
service providers and how the organization must validate
that the service providers,
people processes and technologies comply with the PC IDE CSS requirements is
actually in the standard is written at the start on page 12