Which statement describes 12.8.4's monitoring requirement?

Which statement describes 12.8.4's monitoring requirement?

• A. Maintain a program to monitor service providers' PCI DSS compliance status at least annually.
• B. Monitor service providers monthly with automated scans only.
• C. Ignore service provider compliance.
• D. Require service providers to self-certify without review.

Answer: (A)

The requirement is to have a program that checks and confirms service providers’ PCI DSS compliance status at least once a year. This annual monitoring provides ongoing visibility into third parties that handle cardholder data, ensuring they continue to meet PCI DSS and that you have current evidence of their controls. Monthly scans or an approach focused only on automated checks aren’t what this requirement specifies, and relying on self-certification without any review would not give you the necessary assurance that a provider remains compliant.

The requirement is to have a program that checks and confirms service providers’ PCI DSS compliance status at least once a year. This annual monitoring provides ongoing visibility into third parties that handle cardholder data, ensuring they continue to meet PCI DSS and that you have current evidence of their controls. Monthly scans or an approach focused only on automated checks aren’t what this requirement specifies, and relying on self-certification without any review would not give you the necessary assurance that a provider remains compliant.