Which of the following should be included in a service provider written agreement under 12.8.2?

Which of the following should be included in a service provider written agreement under 12.8.2?

• A. A pricing schedule detailing monthly fees.
• B. An acknowledgement that the service providers are responsible for the security of cardholder data.
• C. A statement that the customer retains all security responsibilities.
• D. A clause allowing data sharing with third parties.

Answer: (B)

This item tests that service-provider relationships include a formal acknowledgement of who is responsible for protecting cardholder data. PCI DSS requires a written agreement with the service provider that explicitly states the service provider is responsible for the security of cardholder data. Framing security responsibility in the contract creates clear accountability, ensures the provider commits to implementing and maintaining appropriate controls, and supports PCI compliance if a breach or audit occurs. The selected option directly aligns with this requirement by affirming the service provider’s responsibility for cardholder data security. A pricing schedule does not establish security obligations. Saying the customer retains all security responsibilities contradicts the purpose of the contract—to allocate responsibility to the service provider where appropriate. Allowing data sharing with third parties is not the point of 12.8.2 and could introduce risk without this contractual acknowledgment of responsibility.

This item tests that service-provider relationships include a formal acknowledgement of who is responsible for protecting cardholder data. PCI DSS requires a written agreement with the service provider that explicitly states the service provider is responsible for the security of cardholder data. Framing security responsibility in the contract creates clear accountability, ensures the provider commits to implementing and maintaining appropriate controls, and supports PCI compliance if a breach or audit occurs.

The selected option directly aligns with this requirement by affirming the service provider’s responsibility for cardholder data security. A pricing schedule does not establish security obligations. Saying the customer retains all security responsibilities contradicts the purpose of the contract—to allocate responsibility to the service provider where appropriate. Allowing data sharing with third parties is not the point of 12.8.2 and could introduce risk without this contractual acknowledgment of responsibility.