12.8.2 Is a written agreement maintained that includes an Observe written agreements acknowledgement that the service providers are Review policies and procedures responsible for the security of cardholder data the service providers possess or otherwise process, or transmit on behalf of the customer, or to the extent that they could impact the security of the customer’s cardholder data environment? Note: The exact wording of an acknowledgement will depend on the agreement between the two parties, the details of the service being provided, and the responsibilities assigned to each party. The acknowledgement does not have to include the exact wording provided in this requirement. 12.8.3 Is there an established process for engaging service Observe processes providers, including proper due diligence prior to Review policies and procedures and engagement? supporting documentation 12.8.4 Is a program maintained to monitor service providers’ PCI Observe processes DSS compliance status at least annually? Review policies and procedures and supporting documentation 12.8.5 Is information maintained about which PCI DSS Observe processes requirements are managed by each service provider, and Review policies and procedures and which are managed by the entity? supporting documentation 12.10.1 Has an incident response plan been created to be Review the incident response plan implemented in the event of system breach? Review incident response plan procedures Does the plan address the following, at a minimum: Roles, responsibilities, and communication and Review incident response plan contact strategies in the event of a compromise procedures including notification of the payment brands, at a minimum?
12.8.2 Is a written agreement maintained that includes an acknowledgement that the service providers are responsible for the security of cardholder data the service providers possess or otherwise process, or transmit on behalf of the customer, or to the extent that they could impact the security of the customer’s cardholder data environment? Note: The exact wording of an acknowledgement will depend on the agreement between the two parties, the details of the service being provided, and the responsibilities assigned to each party. The acknowledgement does not have to include the exact wording provided in this requirement. Observe written agreements Review policies and procedures 12.8.3 Is there an established process for engaging service providers, including proper due diligence prior to engagement? Observe processes Review policies and procedures and supporting documentation 12.8.4 Is a program maintained to monitor service providers’ PCI DSS compliance status at least annually? Observe processes Review policies and procedures and supporting documentation 12.8.5 Is information maintained about which PCI DSS requirements are managed by each service provider, and which are managed by the entity? Observe processes Review policies and procedures and supporting documentation 12.10.1 Has an incident response plan been created to be implemented in the event of system breach? Review the incident response plan Review incident response plan procedures Does the plan address the following, at a minimum: Roles, responsibilities, and communication and contact strategies in the event of a compromise including notification of the payment brands, at a minimum? Review incident response plan procedures