What is a Third-Party Service Provider, or TPSP? It is an organization that has the responsibility to protect card data and may leverage a TPSP to support them in card-processing activities or to secure card data

2. What is a TPSP?
An organization that has the responsibility to protect card data and may leverage a TPSP to support them in card-processing activities or to secure card data

3. Industries relevant to cardholder data
•
Payment gateways
•
Payment processors
•
Colocation services
•
Cloud infrastructure
•
Managed security services
•
Encryption or tokenization services
•
Application hosting
•
Managed firewall/router service providers

4. What to consider when engaging with a TPSP:

5. Set Expectations
Define, agree upon, and document expectations, at least annually and after a change in services.

6. Gain Transparency Scope
Take reasonable steps to determine that the scope of what is provided by a service provider is appropriate and aligned.

7. Establish Communications
Consider establishing a communications schedule.

8. Request Evidence
To verify that appropriate procedures were followed and controls deployed to support changes.

9. Obtain Information about PCI DSS Compliance
Validation documentation should be provided at least annually as evidence of PCI DSS compliance.

10. PCI DSS compliance is a continuous process, not just a point in time exercise

11. Learn more about working with TPSPs
Request a PCI Consultation