Before engaging service providers, 12.8.3 requires what?

Before engaging service providers, 12.8.3 requires what?

• A. A process for engaging service providers that includes due diligence prior to engagement.
• B. Engage without any due diligence to save time.
• C. Only after a security incident.
• D. Document a generic form with no security details.

Answer: (A)

A formal process for engaging service providers that includes due diligence before engagement. PCI DSS requires you to assess and document a provider’s security posture and controls before granting access to cardholder data, and to outline security responsibilities in a written agreement. This pre-engagement due diligence helps prevent data exposure by third parties and sets expectations for ongoing oversight, incident response, data handling, and subcontractor management. Having due diligence up front means you verify that the provider meets security requirements, understand how they handle data, and ensure contracts require specific security controls and responsibilities. This proactive approach reduces risk and aligns with PCI DSS goals of protecting cardholder data. Engaging without due diligence postpones risk assessment, which can lead to gaps and incidents. Waiting until after a security event is too late, and a generic form with no security details fails to establish concrete protections or responsibilities.

A formal process for engaging service providers that includes due diligence before engagement. PCI DSS requires you to assess and document a provider’s security posture and controls before granting access to cardholder data, and to outline security responsibilities in a written agreement. This pre-engagement due diligence helps prevent data exposure by third parties and sets expectations for ongoing oversight, incident response, data handling, and subcontractor management.

Having due diligence up front means you verify that the provider meets security requirements, understand how they handle data, and ensure contracts require specific security controls and responsibilities. This proactive approach reduces risk and aligns with PCI DSS goals of protecting cardholder data.

Engaging without due diligence postpones risk assessment, which can lead to gaps and incidents. Waiting until after a security event is too late, and a generic form with no security details fails to establish concrete protections or responsibilities.