Which information should be maintained about service providers under 12.8.5?

Which information should be maintained about service providers under 12.8.5?

• A. Which PCI DSS requirements are managed by each service provider, and which are managed by the entity.
• B. The provider's contact email.
• C. The provider's preferred contract language.
• D. Which PCI DSS requirements are managed by each service provider, and which are managed by the entity.

Answer: (D)

Responsibility allocation for PCI DSS controls is what this item tests. When you rely on a service provider, you must clearly document which PCI DSS requirements are handled by the provider and which remain under your organization’s control. This clarity is essential for accountability, contract terms, and ongoing oversight, and it helps ensure there are no gaps where a control might be assumed to be covered by the other party. While practical details like contact information or language in the contract can be helpful, they do not establish the critical division of duties that 12.8.5 requires.

Responsibility allocation for PCI DSS controls is what this item tests. When you rely on a service provider, you must clearly document which PCI DSS requirements are handled by the provider and which remain under your organization’s control. This clarity is essential for accountability, contract terms, and ongoing oversight, and it helps ensure there are no gaps where a control might be assumed to be covered by the other party. While practical details like contact information or language in the contract can be helpful, they do not establish the critical division of duties that 12.8.5 requires.