What must organizations maintain when dealing with service providers?

What must organizations maintain when dealing with service providers?

• A. A list of customers.
• B. A list of service providers.
• C. A formal incident response plan.
• D. Only a privacy policy.

Answer: (B)

When dealing with third parties in a PCI context, you need to maintain an up‑to‑date list of all service providers. This keeps track of every external entity that has access to cardholder data or the systems that support it, along with contact details and what each provider is used for. Having this roster makes it possible to perform ongoing risk assessments, ensure contractual security requirements are in place, and coordinate security reviews and incident responses with the right people at the right time. It also supports timely notifications and accountability if a breach or change occurs. A simple list of customers doesn’t address vendor risk or who is handling cardholder data. While a formal incident response plan is important, it’s a separate component of the security program and doesn’t by itself fulfill the need to catalog service providers. A privacy policy is essential for overall data handling, but it doesn’t specifically manage or document your external service relationships.

When dealing with third parties in a PCI context, you need to maintain an up‑to‑date list of all service providers. This keeps track of every external entity that has access to cardholder data or the systems that support it, along with contact details and what each provider is used for. Having this roster makes it possible to perform ongoing risk assessments, ensure contractual security requirements are in place, and coordinate security reviews and incident responses with the right people at the right time. It also supports timely notifications and accountability if a breach or change occurs.

A simple list of customers doesn’t address vendor risk or who is handling cardholder data. While a formal incident response plan is important, it’s a separate component of the security program and doesn’t by itself fulfill the need to catalog service providers. A privacy policy is essential for overall data handling, but it doesn’t specifically manage or document your external service relationships.