← PCI DSS 4.0.1 · Req 12 — Policies and programmes
12.8 — Third-party service provider management
Requirement
Risk to account data from third-party service providers is managed: a list of TPSPs is maintained with a description of services; written agreements include the TPSP's acknowledgement of responsibility for the account data it handles; due diligence precedes engagement; each TPSP's PCI DSS compliance status is monitored at least once every 12 months; and responsibilities are allocated between the entity and the TPSP.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GDPR | Art.28 | Processors and processing agreements | vendor-management third-party |
| CCPA/CPRA | 1798.100(d) | Contracts with service providers, contractors and third parties | vendor-management third-party |
| SOC 2 | CC9.2 | Vendor and business partner risk management | vendor-management third-party |
| ISO 27001 | A.5.19 | Information security in supplier relationships | vendor-management third-party |
| HIPAA | 164.308(b)(1) | Business associate contracts (R) | vendor-management third-party |
| GLBA | 314.4(f) | Oversight of service providers | vendor-management third-party |
| NIST CSF 2.0 | GV.SC-03 | Supply chain risk management is integrated | vendor-management third-party |
| NDPA 2023 | s.29 | Data processor engagement | vendor-management third-party |