Which statement is accurate about the allocation of PCI DSS responsibilities under 12.8.5?

Which statement is accurate about the allocation of PCI DSS responsibilities under 12.8.5?

• A. The service provider's data privacy policy.
• B. The provider's response to audits.
• C. Which PCI DSS requirements are managed by each service provider, and which are managed by the entity.
• D. The customer must sign a confidentiality agreement.

Answer: (C)

Allocating PCI DSS responsibilities between the service provider and the entity is what 12.8.5 focuses on. This requirement asks organizations to define and document which PCI DSS controls are handled by the service provider and which remain the responsibility of the entity. Having a clear split ensures accountability, avoids gaps in coverage, and makes it obvious who must implement or verify each control in outsourced environments. This is why the statement about which PCI DSS requirements are managed by each service provider and which are managed by the entity is the best fit. It directly describes the needed allocation and ownership of controls across parties. The other statements don’t match this concept: a data privacy policy describes privacy practices rather than allocation of PCI duties; the provider’s response to audits is about process rather than defining responsibility for specific controls; and a confidentiality agreement, while important, is not the PCI DSS allocation requirement.

Allocating PCI DSS responsibilities between the service provider and the entity is what 12.8.5 focuses on. This requirement asks organizations to define and document which PCI DSS controls are handled by the service provider and which remain the responsibility of the entity. Having a clear split ensures accountability, avoids gaps in coverage, and makes it obvious who must implement or verify each control in outsourced environments.

This is why the statement about which PCI DSS requirements are managed by each service provider and which are managed by the entity is the best fit. It directly describes the needed allocation and ownership of controls across parties.

The other statements don’t match this concept: a data privacy policy describes privacy practices rather than allocation of PCI duties; the provider’s response to audits is about process rather than defining responsibility for specific controls; and a confidentiality agreement, while important, is not the PCI DSS allocation requirement.