I encountered this question in SAQ A form and the question states:

Is information maintained about which PCI DSS requirements are managed by each service provider, and which are managed by the entity?

Who would be the entity in this case?

2 Answers 2


The entity would be the entity being assessed. The third parties would be the Payment Service Provider handling the transactions on behalf of the entity being assessed. There should be an understanding by the entity being assessed what are the compliance responsibilities being taken on by the Service Provider. This knowledge will allow the entity perform due diligence and monitor the Service Provider is satisfying its compliance requirements.

  • So if an entity is being accessed they should provide info in the name of PSP as well?
    – mko
    Commented Feb 22, 2017 at 9:22
  • 1
    The entity being assessed should have a copy of the PSPs Attestation of Compliance in order to demonstrate they have outsourced cardholder data handling processes to a compliant third party. It is considered the PSP has already provided sufficient evidence to gain their compliance so the entity has no other burden of evidence gathering from the PSP.
    – AndyMac
    Commented Feb 22, 2017 at 14:17

Adding to @AndyMac: The entity in this case is you; the client/merchant receiving the service. PCI DSS 3.2 requires you to understand your (merchant) roles/responsibilities and that of the service provider; this is usually explicitly defined in a document called the Service Provider Responsibility Matrix (SPRM). Merchant's should request this document from every service provider in scope for your PCI DSS Compliance during the due diligence stage along with other documents like their AOC, SAQ, SLA etc. a good example is shown below https://www.akamai.com/uk/en/multimedia/documents/infosec/pci-dss-responsibility-matrix.pdf

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .