12.8.3 Is there an established process for engaging service Observe processes providers, including proper due diligence prior to Review policies and procedures engagement? and supporting documentation 12.8.4 Is a program maintained to monitor service providers’ PCI Observe processes DSS compliance status at least annually? Review policies and procedures and supporting documentation 12.8.5 Is information maintained which PCI DSS Observe processes requirements are managed by each service provider, and Review policies and procedures which are managed by the entity? and supporting documentation 12.9 This requirement applies only to service providers. 12.10 Has an incident response plan been implemented in preparation to respond immediately to a system breach, as follows: 12.10.1 Has an incident response plan been created to be Review the incident response plan implemented in the event of system breach? Review incident response plan procedures Does the plan address the following, at a minimum: Roles, responsibilities, and communication and Review incident response plan contact strategies in the event of a compromise procedures including notification of the payment brands, at a minimum? Specific incident response procedures? Review incident response plan procedures Business recovery and continuity procedures? Review incident response plan procedures Data backup processes? Review incident response plan procedures Analysis of legal requirements for reporting Review incident response plan compromises? procedures
12.8.3 Is there an established process for engaging service providers, including proper due diligence prior to engagement? Observe processes Review policies and procedures and supporting documentation 12.8.4 Is a program maintained to monitor service providers’ PCI DSS compliance status at least annually? Observe processes Review policies and procedures and supporting documentation 12.8.5 Is information maintained which PCI DSS requirements are managed by each service provider, and which are managed by the entity? Observe processes Review policies and procedures and supporting documentation 12.9 This requirement applies only to service providers. 12.10 Has an incident response plan been implemented in preparation to respond immediately to a system breach, as follows: 12.10.1 Has an incident response plan been created to be implemented in the event of system breach? Review the incident response plan Review incident response plan procedures Does the plan address the following, at a minimum: Roles, responsibilities, and communication and contact strategies in the event of a compromise including notification of the payment brands, at a minimum? Review incident response plan procedures Specific incident response procedures? Review incident response plan procedures Business recovery and continuity procedures? Review incident response plan procedures Data backup processes? Review incident response plan procedures Analysis of legal requirements for reporting compromises? Review incident response plan procedures
SAQ_D_v3_Merchant.docx