Item 12.8.3 from the PCI DSS requires the following:

12.8.3 Ensure there is an established process for engaging service providers including proper due diligence prior to engagement.

What is considered "proper due diligence" in this case?

3 Answers 3


12.8.3 is very ambiguously written, but what it boils down to is that you need to vet your potential service provider. You need to have procedural documentation showing the processes behind vetting a service provider. That part is pretty simple.

As far as what you should do to vet your potential service provider, that's a tough call. (and it's up to you to figure the majority of it out) Risk analysis will have to be done. Look into the reputation of the company and their past history. Ask tough questions related to what you are potentially working with the provider.


You would really have to ask a lawyer this question. I am not a lawyer, but my understanding is that the concept is that you should do your best and reasonable effort to ensure that any service providers that will work with the PCI covered information will also be compliant and protect the information to the necessary standards.


We have just gone through this process. In our case the company requesting we complete these forms was the one providing the service. We asked them what this meant. They said simply that we needed to verbally ask them if they were compliant or check on their web site...anyway, they are listed here... http://www.visaeurope.com/en/businesses__retailers/payment_security/service_providers.aspx

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .