12.8.4 Is a program maintained to monitor service providers’ Observe processes PCI DSS compliance status at annually? Review policies and procedures and supporting documentation [Ensure your OST-approved 3rd vendor is on the Visa Global Registry of Service Providers here with an unexpired THROUGH DATE’ ‘VALID and include this document with your SAQ submission: .] 12.8.5 Is information maintained which PCI DSS Observe processes requirements are managed by each service provider, Review policies and procedures and and which are managed by the entity? supporting documentation [Ensure you have this information documented for your OST-approved 3rd vendor.] Has an incident response plan been created to be 12.10.1 Review the incident response plan implemented in the of system breach? Review incident response plan procedures Does the plan address the following, at a minimum: Roles, responsibilities, and communication and Review incident response plan contact strategies in the event of a compromise procedures including notification of the payment brands, at a minimum? Specific incident response procedures? Review incident response plan procedures
12.8.4 Is a program maintained to monitor service providers’ PCI DSS compliance status at annually? Observe processes Review policies and procedures and supporting documentation [Ensure your OST-approved 3rd vendor is on the Visa Global Registry of Service Providers here with an unexpired ‘VALID THROUGH DATE’ and include this document with your SAQ submission: .] 12.8.5 Is information maintained which PCI DSS requirements are managed by each service provider, and which are managed by the entity? Observe processes Review policies and procedures and supporting documentation [Ensure you have this information documented for your OST-approved 3rd vendor.] 12.10.1 Has an incident response plan been created to be implemented in the of system breach? Review the incident response plan Review incident response plan procedures Does the plan address the following, at a minimum: Roles, responsibilities, and communication and contact strategies in the event of a compromise including notification of the payment brands, at a minimum? Review incident response plan procedures Specific incident response procedures? Review incident response plan procedures
saq_c_v3_1_instr.docx