Double-Check Your PCI Service Provider Contract
Written by Walter ConwayA 403 Labs QSA, PCI Columnist Walt Conway has worked in payments and technology for more than 30 years, 10 of them with Visa.
Have you read your contracts with all your PCI service providers lately? These are the third parties that store, process or transmit cardholder data for you. I think you should check your contracts to know whether your service providers are doing all they can to help you become PCI compliant. I am thinking specifically about one particular PCI Requirement.
That Requirement is 12.8.2, which states that merchants need to “maintain a written agreement that includes an acknowledgment that the service providers are responsible for the security of cardholder data the service providers possess.” Some disappointing service providers seem to treat this requirement as an annoying inconvenience. They either pretend it does not exist or isn’t their problem. The result is that you, the retailer, are caught in the lurch.
If your contracts do not address this Requirement specifically, your service providers are not doing all they should be doing to help you be PCI compliant. As a retail CIO, this oversight means you have to do more work to become compliant and, what may be worse in this time of tight budgets, you are not getting all you are paying for.
I would like to compliment those many PCI service providers that are not just compliant themselves but actually help their customers become PCI compliant. These organizations acknowledge in writing that they are responsible for protecting their clients’ cardholder data. Let me give you one example.
This Level 1 service provider offers the following wording in its contract: Service provider “is responsible for the security of credit card information in its possession.” That is succinct, and in this QSA’s opinion, it addresses 12.8.2 pretty directly. Then, for good measure, the provider calls out the actual PCI Requirement and adds: Service provider agrees “to maintain proper security and responsibility for cardholder data while it is in its possession.”
This service provider and all the others that take this responsibility merit a gold star. Sadly, I can’t give a gold star to every service provider I’ve seen.
Compare the response above to what I read from another service provider. This one’s marketing materials note how secure it is and then describes all the great ways the provider helps its merchants maintain PCI compliance. When asked to acknowledge its responsibilities under 12.8.2, this provider sent the following E-mail to its customer: Service provider “is not able to meet that request.”
That one sentence was the complete response. No offer to talk about it was made, nor was there room for negotiation. I guess the reply meets my succinctness test, but it is an epic FAIL as far as PCI is concerned. This service provider’s position is unacceptable.
-Marc
July 28th, 2010 at 3:44 pm
Another important question is: Who will be liable if the service provider’s system is breached, or if the software or systems provided to the merchant contain vulnerabilities that enabled a breach?
In almost ever case, it is the merchant who will be held responsible by the acquirer and card brands, because those parties have no contractual relationship with the service provider. In theory, the merchant might be able to file a claim against the service provider, but many service providers require merchants to waive the right to such claims. Some even require merchants to indemnify the service provider against claims from third parties (i.e cardholders and acquirers).
Even assuming the merchant did sue, and win, it would probably be a hollow victory: Most service providers lack sufficient resources to pay tens of millions of dollars (or more) in claims that could be made against them by the hundreds or thousands of merchants they service.
Using a service provider does not automatically provide a merchant with a “free pass” to avoid liability, regardless of what the merchant’s agreement with the service provider might state.
July 29th, 2010 at 7:23 am
I believe we need better consistency use of the term service provider. I’m familiar with QSAs and CIOs who expand the definition beyond storing, processing and transmitting cardholder data to anyone who accesses the cardholder environment. This wider net catches those who provide remote help desk support, on-site PC technicians and more. There doesn’t seem to be any issue having these entities agree to 12.8.2; however, enforcing strict interpretation of 12.8.4 – “maintain a program to monitor service providers’ PCI-DSS compliance status” – is tough. I don’t believe the PCI-SSC will process a ROC for Jim’s PC Rescue in Butte, Montana. Apologies if you’re a computer tech in Butte. Hopefully, the merchants controls limit risk from these other groups, but it seems that we need better tools and processes to help both the merchants and the vendors maintain secure operations.
July 29th, 2010 at 7:48 pm
This is a very timely article for me. I work in franchise/independent dealer model. Some our our retailers have seen advertisements from LogMeIn (web based remote control software) that suggests PCI compliance is no problem. However, upon contacting them about 12.8.2, we’ve learned they’re unable/unwilling to agree. Hence, not really PCI compliant as far as our QSA is concerned. It’s confusing to our retailers who see the ads for this and other software and then challenge us on why they can’t use the solutions. This article helps provide some “evidence” to our customers regarding this situation.
July 29th, 2010 at 8:57 pm
@ PCI Guy and Chris,
Many thanks for your comments (and sympathies, Chris, for your plight!).
My recommendations to my clients is that their vendor “agreement” have at least the following points:
• They attest that they are responsible for maintaining their compliance with all applicable payment card association rules including PCI DSS. (This can also help you meet 12.8.4.)
• They accept responsibility for the security of all payment card data (as defined in the PCI DSS) in its possession.
• They will notify you within _____ hours if they have a data breach (e.g. within 24 or 48 hours; I like 24).
• They are responsible for 100% of any financial fines, penalties, and costs if they are solely responsible for a breach.
Now, to be fair, they will want some commitment from you that you will follow all your security policies, update your systems and links to them as appropriate, that you will remain PCI compliant, too, and that you report any problems immediately.
Maybe these can address some of the issues raised.
I find it interesting that the Council changed the requirement from a “contract” to an “agreement” with version 1.2. This gives you and your service provider some room, although not being a lawyer I won’t pretend to comment on the difference between the two. What you want, though, is the service provider’s commitment in writing by a responsible officer of the company.