Which describes the due diligence before engaging service providers?

Which describes the due diligence before engaging service providers?

• A. A process for engaging service providers that includes due diligence prior to engagement.
• B. A process that includes due diligence after engagement.
• C. No due diligence is required.
• D. A process that ignores due diligence.

Answer: (A)

The key idea is to perform due diligence on service providers before you engage them. Before you sign a contract or grant access to systems or cardholder data, you should evaluate the provider’s security controls, confirm they meet PCI requirements, and establish expectations in a written agreement that assigns responsibility for protecting data. This pre-engagement step helps ensure you’re bringing on a partner who can actually safeguard cardholder data and align with your PCI compliance responsibilities, reducing risk from the outset. Doing due diligence after engagement or skipping it altogether leaves you exposed because security controls haven’t been vetted and contractual liabilities haven’t been defined yet. While ongoing oversight is important, the described process specifically emphasizes evaluating and confirming security readiness before onboarding the provider.

The key idea is to perform due diligence on service providers before you engage them. Before you sign a contract or grant access to systems or cardholder data, you should evaluate the provider’s security controls, confirm they meet PCI requirements, and establish expectations in a written agreement that assigns responsibility for protecting data. This pre-engagement step helps ensure you’re bringing on a partner who can actually safeguard cardholder data and align with your PCI compliance responsibilities, reducing risk from the outset.

Doing due diligence after engagement or skipping it altogether leaves you exposed because security controls haven’t been vetted and contractual liabilities haven’t been defined yet. While ongoing oversight is important, the described process specifically emphasizes evaluating and confirming security readiness before onboarding the provider.