01
Service and Scope Mapping
Define which products, platforms, environments and operational services are included in the PCI assessment.
PCI DSS for Service Providers
Your Customers Need More Than a PCI Badge They Need to Know What Your Service Actually Covers
Service providers sit inside other organisations' PCI compliance programmes. That means your own assessment has to do two jobs: validate your controls and give customers clear evidence about which PCI DSS requirements your service is meeting or affecting.
2-sec helps service providers define the service boundary, map customer and provider responsibilities, prepare assessment evidence and build a PCI validation package customers can actually use in their own compliance work.
A Different PCI Relationship
Service Provider Compliance Has to Stand Up to Customer Due Diligence
A PCI DSS service provider may store, process or transmit account data on behalf of customers, manage systems within a customer's CDE, or provide services that can affect the security of customer account data. Those relationships create specific scope, evidence and responsibility questions.
PCI SSC expects TPSPs that meet PCI DSS requirements on behalf of customers to provide sufficient evidence showing that the relevant services and requirements were assessed. Customers, in turn, must understand shared responsibilities and monitor their TPSPs.
Service Provider PCI Support
Build a PCI Position Customers Can Understand and Rely On
For service providers, the assessment boundary has to connect the technical service, the contractual service and the PCI evidence customers receive.
02
Customer Responsibility Matrix
Document which PCI DSS requirements are met by the provider, which remain with the customer and where responsibilities are shared.
03
SAQ D or RoC Readiness
Prepare the evidence and control environment for the validation route that applies to the service provider.
04
Cloud and Platform Scoping
Map shared infrastructure, SaaS, PaaS, IaaS and administrative services that can affect customer CDEs.
05
Customer Evidence Package
Prepare current AOC, scope descriptions and supporting information customers need for third-party due diligence.
06
Ongoing Change Management
Assess how new services, platform changes and customer use cases affect PCI scope and previously documented responsibilities.
What Customers Will Ask
A Service Provider's PCI Evidence Needs to Answer Practical Questions
An AOC is important, but customers often need to understand what sits behind it.
Which Services Were Assessed?The evidence should identify the service or platform scope relevant to the customer.
Which Requirements Do You Meet for Us?Customers need a clear responsibility split rather than an assumption that 'the provider handles PCI'.
Is the Evidence Current?Customers are expected to monitor TPSP compliance status at least annually.
Does Your Scope Cover Our Use Case?A provider assessment only helps if the customer's actual service is inside the assessed scope.
What Happens When the Service Changes?New features, hosting models or access paths can change PCI applicability.
Who Has Access to the CDE?Remote support, administration and operational access can affect TPSP classification and scope.
What Third Parties Do You Depend On?Subservice organisations can create further responsibility and evidence dependencies.
What Can We Give Our Assessor?Customers need usable evidence for their own PCI validation.
How 2-sec Approaches It
A Service-Provider PCI Programme Built for Assessment and Customer Assurance
01
Define the Service Boundary
Map the services, systems, locations and customer-facing functions included in PCI scope.
02
Map Responsibilities
Separate provider, customer and shared PCI DSS obligations.
03
Assess Controls and Evidence
Review the service against applicable requirements and close readiness gaps.
04
Complete Validation
Prepare for SAQ D for Service Providers or the required QSA-led assessment route.
05
Package Customer Evidence
Provide clear documentation showing assessed services and responsibility coverage.
06
Maintain the Position
Monitor compliance, service changes and evidence customers rely on throughout the year.
For a service provider, PCI compliance is not only about passing the assessment. It is about giving every customer a defensible answer to 'What are you covering for us?'
Review Your Service Provider PCI Position ↗Service Provider PCI Questions
Frequently Asked Questions About PCI DSS for Service Providers
What makes a company a PCI DSS service provider?
A service provider may store, process or transmit account data on behalf of another entity, manage systems in a customer's CDE, or provide services that can affect the security of account data.
What evidence should a TPSP give customers?
PCI SSC says a TPSP is expected to provide evidence showing that the services relevant to the customer were in assessment scope and that applicable PCI DSS requirements were assessed and in place. A current AOC is commonly part of that evidence.
Is an SAQ A AOC enough for a service provider to demonstrate PCI compliance to customers?
No. PCI SSC states that evidence limited to merchant SAQ requirements, such as SAQ A, is not sufficient evidence of PCI DSS compliance for a TPSP's merchant customers.
Do our customers still have PCI responsibilities if we are compliant?
Yes. Customers retain responsibility for managing TPSP relationships, understanding shared requirements and monitoring provider compliance status.
Can software vendors or resellers become TPSPs?
They can, depending on the service. PCI SSC states that a vendor providing only a product may not be a TPSP, while ongoing operation, maintenance or access to the customer's CDE can make the relationship a TPSP service.
Continue Your PCI DSS Journey
Related PCI DSS Services
PCI QSA ServicesGet QSA-led guidance on service-provider scope, validation expectations and how responsibilities should be evidenced for customers and assessors.PCI DSS RoC AssessmentPrepare for detailed QSA reporting with a clear service boundary, responsibility model and evidence package that customers can rely on.PCI DSS ScopingDefine the platforms, services, systems and customer-impact boundaries that determine what belongs inside the service provider assessment.