Which statement about Service Providers is correct?

Which statement about Service Providers is correct?

• A. A bank that issues cards
• B. A merchant acquiring service
• C. A payment brand
• D. A business not a payment brand that processes, stores, or transmits cardholder data on behalf of another entity

Answer: (D)

The key idea here is understanding who PCI DSS calls a service provider. A service provider is a business that processes, stores, or transmits cardholder data on behalf of another entity, or that has access to that data to do so. It’s not a card issuer and it’s not a payment brand; it’s a third party that handles card data for someone else. That’s why the statement describing a business that processes, stores, or transmits cardholder data on behalf of another entity fits perfectly. It matches the role of a processor or similar third party that operates within a merchant’s cardholder data environment. The other statements describe parts of the payments ecosystem that aren’t service providers by definition: a bank that issues cards is an issuer; a payment brand is the network (like Visa or Mastercard); and a merchant acquiring service relates to the entity that processes transactions for merchants, which isn’t the third-party processor/handler of cardholder data described in the service provider role.

The key idea here is understanding who PCI DSS calls a service provider. A service provider is a business that processes, stores, or transmits cardholder data on behalf of another entity, or that has access to that data to do so. It’s not a card issuer and it’s not a payment brand; it’s a third party that handles card data for someone else.

That’s why the statement describing a business that processes, stores, or transmits cardholder data on behalf of another entity fits perfectly. It matches the role of a processor or similar third party that operates within a merchant’s cardholder data environment.

The other statements describe parts of the payments ecosystem that aren’t service providers by definition: a bank that issues cards is an issuer; a payment brand is the network (like Visa or Mastercard); and a merchant acquiring service relates to the entity that processes transactions for merchants, which isn’t the third-party processor/handler of cardholder data described in the service provider role.