Double-Check Your PCI Service Provider Contract

Written by Walter Conway
July 28th, 2010

A 403 Labs QSA, PCI Columnist Walt Conway has worked in payments and technology for more than 30 years, 10 of them with Visa.

Have you read your contracts with all your PCI service providers lately? These are the third parties that store, process or transmit cardholder data for you. I think you should check your contracts to know whether your service providers are doing all they can to help you become PCI compliant. I am thinking specifically about one particular PCI Requirement.

That Requirement is 12.8.2, which states that merchants need to “maintain a written agreement that includes an acknowledgment that the service providers are responsible for the security of cardholder data the service providers possess.” Some disappointing service providers seem to treat this requirement as an annoying inconvenience. They either pretend it does not exist or isn’t their problem. The result is that you, the retailer, are caught in the lurch.

If your contracts do not address this Requirement specifically, your service providers are not doing all they should be doing to help you be PCI compliant. As a retail CIO, this oversight means you have to do more work to become compliant and, what may be worse in this time of tight budgets, you are not getting all you are paying for.

I would like to compliment those many PCI service providers that are not just compliant themselves but actually help their customers become PCI compliant. These organizations acknowledge in writing that they are responsible for protecting their clients’ cardholder data. Let me give you one example.

This Level 1 service provider offers the following wording in its contract: Service provider “is responsible for the security of credit card information in its possession.” That is succinct, and in this QSA’s opinion, it addresses 12.8.2 pretty directly. Then, for good measure, the provider calls out the actual PCI Requirement and adds: Service provider agrees “to maintain proper security and responsibility for cardholder data while it is in its possession.”

This service provider and all the others that take this responsibility merit a gold star. Sadly, I can’t give a gold star to every service provider I’ve seen.

Compare the response above to what I read from another service provider. This one’s marketing materials note how secure it is and then describes all the great ways the provider helps its merchants maintain PCI compliance. When asked to acknowledge its responsibilities under 12.8.2, this provider sent the following E-mail to its customer: Service provider “is not able to meet that request.”

That one sentence was the complete response. No offer to talk about it was made, nor was there room for negotiation. I guess the reply meets my succinctness test, but it is an epic FAIL as far as PCI is concerned. This service provider’s position is unacceptable.


Comments are closed.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.