Double-Check Your PCI Service Provider Contract

Written by Walter Conway
July 28th, 2010

A 403 Labs QSA, PCI Columnist Walt Conway has worked in payments and technology for more than 30 years, 10 of them with Visa.

Have you read your contracts with all your PCI service providers lately? These are the third parties that store, process or transmit cardholder data for you. I think you should check your contracts to know whether your service providers are doing all they can to help you become PCI compliant. I am thinking specifically about one particular PCI Requirement.

That Requirement is 12.8.2, which states that merchants need to “maintain a written agreement that includes an acknowledgment that the service providers are responsible for the security of cardholder data the service providers possess.” Some disappointing service providers seem to treat this requirement as an annoying inconvenience. They either pretend it does not exist or isn’t their problem. The result is that you, the retailer, are caught in the lurch.

If your contracts do not address this Requirement specifically, your service providers are not doing all they should be doing to help you be PCI compliant. As a retail CIO, this oversight means you have to do more work to become compliant and, what may be worse in this time of tight budgets, you are not getting all you are paying for.

I would like to compliment those many PCI service providers that are not just compliant themselves but actually help their customers become PCI compliant. These organizations acknowledge in writing that they are responsible for protecting their clients’ cardholder data. Let me give you one example.

This Level 1 service provider offers the following wording in its contract: Service provider “is responsible for the security of credit card information in its possession.” That is succinct, and in this QSA’s opinion, it addresses 12.8.2 pretty directly. Then, for good measure, the provider calls out the actual PCI Requirement and adds: Service provider agrees “to maintain proper security and responsibility for cardholder data while it is in its possession.”

This service provider and all the others that take this responsibility merit a gold star. Sadly, I can’t give a gold star to every service provider I’ve seen.

Compare the response above to what I read from another service provider. This one’s marketing materials note how secure it is and then describes all the great ways the provider helps its merchants maintain PCI compliance. When asked to acknowledge its responsibilities under 12.8.2, this provider sent the following E-mail to its customer: Service provider “is not able to meet that request.”

That one sentence was the complete response. No offer to talk about it was made, nor was there room for negotiation. I guess the reply meets my succinctness test, but it is an epic FAIL as far as PCI is concerned. This service provider’s position is unacceptable.


4 Comments | Read Double-Check Your PCI Service Provider Contract

  1. PCI Guy Says:

    Another important question is: Who will be liable if the service provider’s system is breached, or if the software or systems provided to the merchant contain vulnerabilities that enabled a breach?

    In almost ever case, it is the merchant who will be held responsible by the acquirer and card brands, because those parties have no contractual relationship with the service provider. In theory, the merchant might be able to file a claim against the service provider, but many service providers require merchants to waive the right to such claims. Some even require merchants to indemnify the service provider against claims from third parties (i.e cardholders and acquirers).

    Even assuming the merchant did sue, and win, it would probably be a hollow victory: Most service providers lack sufficient resources to pay tens of millions of dollars (or more) in claims that could be made against them by the hundreds or thousands of merchants they service.

    Using a service provider does not automatically provide a merchant with a “free pass” to avoid liability, regardless of what the merchant’s agreement with the service provider might state.

  2. pcidssguy Says:

    I believe we need better consistency use of the term service provider. I’m familiar with QSAs and CIOs who expand the definition beyond storing, processing and transmitting cardholder data to anyone who accesses the cardholder environment. This wider net catches those who provide remote help desk support, on-site PC technicians and more. There doesn’t seem to be any issue having these entities agree to 12.8.2; however, enforcing strict interpretation of 12.8.4 – “maintain a program to monitor service providers’ PCI-DSS compliance status” – is tough. I don’t believe the PCI-SSC will process a ROC for Jim’s PC Rescue in Butte, Montana. Apologies if you’re a computer tech in Butte. Hopefully, the merchants controls limit risk from these other groups, but it seems that we need better tools and processes to help both the merchants and the vendors maintain secure operations.

  3. Chris Says:

    This is a very timely article for me. I work in franchise/independent dealer model. Some our our retailers have seen advertisements from LogMeIn (web based remote control software) that suggests PCI compliance is no problem. However, upon contacting them about 12.8.2, we’ve learned they’re unable/unwilling to agree. Hence, not really PCI compliant as far as our QSA is concerned. It’s confusing to our retailers who see the ads for this and other software and then challenge us on why they can’t use the solutions. This article helps provide some “evidence” to our customers regarding this situation.

  4. Walt Conway Says:

    @ PCI Guy and Chris,

    Many thanks for your comments (and sympathies, Chris, for your plight!).

    My recommendations to my clients is that their vendor “agreement” have at least the following points:

    • They attest that they are responsible for maintaining their compliance with all applicable payment card association rules including PCI DSS. (This can also help you meet 12.8.4.)

    • They accept responsibility for the security of all payment card data (as defined in the PCI DSS) in its possession.

    • They will notify you within _____ hours if they have a data breach (e.g. within 24 or 48 hours; I like 24).

    • They are responsible for 100% of any financial fines, penalties, and costs if they are solely responsible for a breach.

    Now, to be fair, they will want some commitment from you that you will follow all your security policies, update your systems and links to them as appropriate, that you will remain PCI compliant, too, and that you report any problems immediately.

    Maybe these can address some of the issues raised.

    I find it interesting that the Council changed the requirement from a “contract” to an “agreement” with version 1.2. This gives you and your service provider some room, although not being a lawyer I won’t pretend to comment on the difference between the two. What you want, though, is the service provider’s commitment in writing by a responsible officer of the company.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.