c12.5 Third-party service provider (TPSP) risk management and shared responsibility
Manage the risk associated with service providers that have access to account data or that can affect CDE security, including AWS, with a clear shared responsibility matrix.
Requirement 12
Support Information Security with Organizational Policies and Programs
PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.
12.8 Risk to information assets associated with third-party service provider (TPSP) relationships is managed
- 12.8.1 List of third-party service providers (TPSPs) maintained Your responsibility
- 12.8.2 Written agreements with TPSPs maintained Your responsibility
- 12.8.3 Process for engaging TPSPs including due diligence Your responsibility
- 12.8.4 Program to monitor TPSP PCI DSS compliance status Your responsibility
- 12.8.5 Information about PCI DSS responsibilities managed with TPSPs Your responsibility
How to implement on AWS
Maintain a list of TPSPs (including AWS) and monitor their PCI compliance status through the AOCs obtained in AWS Artifact. Document in writing which requirements each party manages (shared responsibility matrix). Review the TPSPs' compliance status at least annually.
Practical implementation
How this control is implemented in each reference architecture:
Track every third-party service provider (including AWS), monitor their PCI status, and document who owns which requirement.
- Maintain a TPSP list (including AWS) with the service each provides.
- Monitor each TPSP's PCI compliance via their AOCs, obtaining the AWS AOC from AWS Artifact.AWS Artifact / evidence
AWS Artifact - Keep a written shared-responsibility matrix mapping each PCI requirement to AWS, the entity, or shared; review annually.
How to validate: The TPSP list is current, each provider's PCI status is monitored (AWS AOC on file), and the responsibility matrix covers every requirement.
Avoid: Assuming 'AWS is compliant so we're covered'. Document exactly which requirements AWS owns vs. you in the responsibility matrix.
Manage the TPSP list and AWS AOCs once at the org level with a single responsibility matrix for the whole PCI OU.
- Obtain the AWS AOC once via AWS Artifact organization agreements for the whole org.Management/Artifact (org) AWS Artifact
AWS Organizations - Maintain the TPSP list and PCI-status monitoring at the organization level.
- Keep one shared-responsibility matrix that applies to every account under the PCI OU.
How to validate: A single org-level TPSP register, AWS AOC, and responsibility matrix cover all PCI OU accounts and are reviewed annually.
Avoid: A separate TPSP register/matrix per account. Manage it once at the org level so nothing conflicts or lapses.
PCI validation
Testing procedures
- Examine documentation to verify a list of all TPSPs is maintained with a description of the services provided (12.8.1.b).
- Examine documentation and interview personnel to verify each TPSP's PCI DSS compliance status is monitored at least every 12 months (12.8.4.b).
- Verify the entity maintains information about which PCI DSS requirements are managed by each TPSP, by the entity, or shared (12.8.5.a, 12.8.5.b).
Evidence in AWS
- TPSP list including AWS and their AOCs obtained via AWS Artifact.
- Shared responsibility matrix by PCI requirement.
- Evidence of annual review of the TPSPs' compliance status.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 12.8 — Records are maintained of third-party service providers (TPSPs) and the services provided, and their PCI DSS compliance status is monitored.
AWS services
AWS Artifact Learning resources
References
- PCI DSS v4.0.1 Requirement 12.8