12.8.1 Is a list of service providers maintained? Review policies and procedures Observe processes Review list of service providers [Business Affairs a master list of service providers using information provided by merchants. Please keep a local list as well and inform Business Affairs when service provider changes are made.] 12.8.2 Is a written agreement maintained that includes an Observe written agreements acknowledgement that the service providers are Review policies and procedures responsible for the security of cardholder data the [Ensure you have a written agreement service providers possess or otherwise process, or in place for your OST-approved 3rd transmit on behalf of the customer, or to the extent that party vendor.] they could impact the security of the customer’s cardholder data environment? Note: The exact wording of an acknowledgement will depend on the agreement between the two parties, the details of the service being provided, and the responsibilities assigned to each party. The acknowledgement does not have to include the exact wording provided in this requirement. 12.8.3 Is there an established process for engaging service Observe processes providers, including proper due diligence prior to Review policies and procedures and engagement? supporting documentation
12.8.1 Is a list of service providers maintained? Review policies and procedures Observe processes Review list of service providers [Business Affairs a master list of service providers using information provided by merchants. Please keep a local list as well and inform Business Affairs when service provider changes are made.] 12.8.2 Is a written agreement maintained that includes an acknowledgement that the service providers are responsible for the security of cardholder data the service providers possess or otherwise process, or transmit on behalf of the customer, or to the extent that they could impact the security of the customer’s cardholder data environment? Note: The exact wording of an acknowledgement will depend on the agreement between the two parties, the details of the service being provided, and the responsibilities assigned to each party. The acknowledgement does not have to include the exact wording provided in this requirement. Observe written agreements Review policies and procedures [Ensure you have a written agreement in place for your OST-approved 3rd party vendor.] 12.8.3 Is there an established process for engaging service providers, including proper due diligence prior to engagement? Observe processes Review policies and procedures and supporting documentation
saq_c_v3_1_instr.docx