Third-party service providers are validated for PCI compliance
Why it matters
PCI-DSS 4.0 Req 12.8 requires that policies and procedures for managing service providers who handle cardholder data are documented and implemented; Req 12.8.4 requires that the compliance status of service providers is monitored at least annually. Every third-party service that touches your CDE — payment processor, hosting provider, monitoring platform — extends your PCI scope. If Stripe, AWS, or a logging vendor has a compliance gap you haven't verified, that gap becomes your liability. ISO 27001:2022 A.5.19 and SOC 2 CC9.2 both require third-party risk management as a formal program.
Severity rationale
Low because vendor compliance gaps require both the vendor being compromised and your systems being affected — the risk is real but mediated by the vendor's own controls, placing direct impact one step removed.
Remediation
Create docs/vendor-compliance.md listing every third-party service that accesses or processes cardholder data, with its compliance status, AOC or SOC 2 report reference, and last review date. Review and update this document at least annually per Req 12.8.4.
| Vendor | Role | Compliance | Last Verified |
|---------|---------------------|-------------------|---------------|
| Stripe | Payment processing | PCI DSS Level 1 | 2026-01-30 |
| AWS | Infrastructure | SOC 2 Type II | 2026-01-15 |
| Datadog | Monitoring | PCI DSS Level 1 | 2026-01-20 |
For each vendor, download their AOC or SOC 2 report annually from their security portal (Stripe: stripe.com/docs/security, AWS: aws.amazon.com/compliance) and store a reference in the table. Add a calendar reminder to repeat this review before your annual PCI assessment.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the PCI Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- pci-dss:4.0 · Req 12.8 — Risk to information assets associated with third-party service provider (TPSP) relationships is managed
- pci-dss:4.0 · Req 12.8.4 — A program is implemented to monitor TPSPs' PCI DSS compliance status at least once every 12 months
- iso-27001:2022 · A.5.19 — Information security in supplier relationships
- soc2:2017 · CC9.2 — Manages Changes to Vendor and Business Partner Relationships
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ecommerce-pci·automated