Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Item 12.8.3 from the PCI DSS requires the following:

12.8.3 Ensure there is an established process for engaging service providers including proper due diligence prior to engagement.

What is considered "proper due diligence" in this case?

share|improve this question
up vote 1 down vote accepted

12.8.3 is very ambiguously written, but what it boils down to is that you need to vet your potential service provider. You need to have procedural documentation showing the processes behind vetting a service provider. That part is pretty simple.

As far as what you should do to vet your potential service provider, that's a tough call. (and it's up to you to figure the majority of it out) Risk analysis will have to be done. Look into the reputation of the company and their past history. Ask tough questions related to what you are potentially working with the provider.

share|improve this answer

You would really have to ask a lawyer this question. I am not a lawyer, but my understanding is that the concept is that you should do your best and reasonable effort to ensure that any service providers that will work with the PCI covered information will also be compliant and protect the information to the necessary standards.

share|improve this answer

We have just gone through this process. In our case the company requesting we complete these forms was the one providing the service. We asked them what this meant. They said simply that we needed to verbally ask them if they were compliant or check on their web site...anyway, they are listed here...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.