PCI SSC Clarifies Third-Party Provider Responsibilities
Updated:
November 15, 2026
PCI SSC’s new service-provider guidance explains how customers and providers share payment-security responsibilities. Released November 10, 2026, the supplement clarifies provider oversight and the evidence businesses need to assess services that can affect their payment environments.
This article goes through exactly which providers fall within scope, how customers and providers divide responsibilities and what compliance evidence businesses should review.
It also covers ongoing monitoring and why outsourcing a service does not remove the customer’s responsibility to manage payment-security risks.
Let’s find out
What Is Understanding PCI DSS Service Providers?
Understanding PCI DSS Service Providers is a PCI SSC information supplement explaining existing requirements for customer and third-party provider relationships.
With the Council’s Board of Advisors and Global Executive Assessor Roundtable, PCI SSC developed the supplement in response to questions about these relationships. It includes a provider decision flow and a 7-step management lifecycle.
The supplement does not replace or supersede PCI DSS. Organizations still need to apply the standard’s requirements to their own services and scope.
What Does Understanding PCI DSS Service Providers Say About Customer Oversight?
For customers, Understanding PCI DSS Service Providers explains that Requirement 12.8 covers provider lists, due diligence, written agreements and compliance monitoring at least once every 12 months.
Within a responsibility matrix, customers need to record which requirements belong to the provider, which remain with the customer and which are shared.
For a shared control such as log review, the matrix states which party collects the logs and which party reads them. A gap appears wherever neither party has responsibility.
A distinction matters here: Requirement 12.8 itself does not demand that every provider hold a validated PCI DSS compliance status. It requires customers to monitor that status. However, when a provider performs a PCI DSS control for a customer, evidence that the control works affects the customer’s assessment.
For example, a business outsourcing network security controls needs evidence that the provider meets the applicable requirements. Without that evidence, the customer cannot treat those requirements as satisfied simply because the work appears in a contract.
What Evidence Does Understanding PCI DSS Service Providers Expect From Providers?
For providers, Understanding PCI DSS Service Providers explains that Requirement 12.9 calls for written acknowledgment of responsibilities and support for customer requests for compliance information.
With an applicable Attestation of Compliance, a provider is expected to share that evidence on request. The AOC must cover the services the customer uses and the relevant requirements.
A provider’s assessed scope therefore matters as much as the existence of the document. Evidence for one service does not demonstrate that another service was assessed.
Customers may request relevant sections of a Report on Compliance or a Self-Assessment Questionnaire D for Service Providers. When a provider lacks an applicable AOC, it is expected to supply specific evidence so the customer or assessor can verify the relevant controls.
Which Providers Fall in Scope Under Understanding PCI DSS Service Providers?
For services that can affect payment security, Understanding PCI DSS Service Providers explains that scope can extend beyond direct handling of card data.
PCI DSS can apply to providers that affect payment security even when they do not directly store, process or transmit payment account data. PCI SSC’s scope clarification includes services with access to the cardholder data environment and services that perform security controls for customers.
This can include a provider operating network security controls or anti-malware protections. The relevant question is what the service can access or affect.
For multi-tenant services, the Council points to administrative control as the distinguishing factor. For nested providers, the guidance explains how responsibility flows through the service-provider chain.
What Should Businesses Do To Follow Understanding PCI DSS Service Providers?
After reviewing Understanding PCI DSS Service Providers, businesses can compare their contracts, responsibility matrices and assessment evidence. Following are 4 practical checks:
- Build one matrix row per applicable PCI DSS requirement, with columns for customer responsibility, provider responsibility, shared responsibility and supporting evidence.
- Compare each provider’s assessed AOC services with the current contract. Obtain separate evidence for a service outside the AOC’s scope.
- Schedule each provider review 30 days before its AOC anniversary as an internal planning measure. Continue monitoring compliance at least once every 12 months.
- Reassess a vendor’s classification and scope when it gains remote access to the cardholder data environment.
Bright Defense’s PCI DSS services support gap reviews and remediation. Its Continuous Cybersecurity Complianceprogram supports third-party risk management and evidence collection. Use Contact Us to discuss your provider oversight.
How Bright Defense Helps Strengthen PCI DSS Provider Oversight
Bright Defense’s PCI DSS services help your business review gaps in payment-security controls, including responsibilities shared with service providers. A review can compare contracts, responsibility matrices, and supporting evidence to flag unassigned work and services that fall outside a provider’s assessed scope.
Our Continuous Cybersecurity Compliance program supports third-party risk management and evidence collection. Your team can organize provider records, assign review owners, and track missing evidence or corrective actions as services and access permissions change.
Contact Bright Defense to review your provider oversight and clarify who owns the controls protecting your payment environment.
Frequently Asked Questions
1. Are We Still Responsible if a Provider Handles All Our Payment Processing?
Yes. Outsourcing does not remove your responsibility to oversee the provider and understand the requirements that remain with your business. Document the division of work and monitor the provider’s compliance status for the services you use.
2. Is a Provider’s Attestation of Compliance Enough?
Only when its scope and findings support the services and requirements you rely on. Check what was assessed and which responsibilities remain yours. A document covering another service does not demonstrate compliance for your arrangement.
3. What Should We Do if Our Provider Cannot Supply an AOC?
Request specific evidence showing that it meets the applicable requirements. PCI SSC’s guidance allows the customer or assessor to evaluate that evidence. An absent AOC does not automatically settle the question, but unsupported outsourced controls can affect your assessment.
4. How Often Must We Check Our Provider’s PCI DSS Compliance Status?
Requirement 12.8 calls for monitoring at least once every 12 months. Keeping an owner and review date for each provider can help prevent missed checks. Consider whether service changes make previously collected evidence less relevant.
5. Does Our IT Provider Count if It Never Sees Card Numbers?
It can. Providers that access the cardholder data environment or operate controls affecting its security may fall within scope. Evaluate the actual access and services, including remote administration or managed security, instead of relying on the provider’s business label.
Sources
- PCI SSC, PCI SSC Publishes New Guidance on Understanding PCI DSS Third-Party Service Providers. https://blog.pcisecuritystandards.org/pci-ssc-publishes-new-guidance-on-understanding-pci-dss-third-party-service-providers
- PCI SSC, FAQ 1312 on monitoring third-party provider compliance. https://www.pcisecuritystandards.org/faqs/1312/
- PCI SSC, FAQ 1576 on provider compliance evidence. https://www.pcisecuritystandards.org/faqs/1576/
- PCI SSC, FAQ 1579 on providers that can affect payment security. https://www.pcisecuritystandards.org/faqs/1579/
