Insights | Integrity360

Why a PCI DSS third-party service provider’s AOC is not enough

Written by Alessandro Amalfitano | 10 August 2026, 05:00:00 Z

Saying that a third-party service provider is “PCI compliant” is not a conclusion; it is the starting point for further verification.

For many organisations, third-party assurance still amounts to obtaining an Attestation of Compliance (AOC), saving it in a repository and assuming that no further review is required. However PCI DSS requires more than evidence that a provider completed an assessment at some point.

You need to establish whether the provider is in scope, which services have been assessed, what responsibilities it has accepted, whether its validation remains current and whether the evidence actually supports the services your organisation consumes.

The PCI Security Standards Council has clarified how third-party service providers should be scoped, validated and documented during a PCI DSS assessment. The guidance highlights an important point: providers do not need to store, process or transmit account data to fall within scope. They may also be in scope because their services help meet PCI DSS requirements or could affect the security of the cardholder data environment.

This has significant implications for merchants, service providers and assessors.

 

 

What is a third-party service provider under PCI DSS?

For the purposes of a customer’s PCI DSS assessment, a third-party service provider relationship is relevant where the provider delivers services that:

  • Store, process or transmit account data on behalf of the customer;
  • Manage systems or controls used by the customer to meet one or more PCI DSS requirements;
  • Could affect the security of customer’s account data or cardholder data environment.

The third point is where organisations frequently underestimate their scope.

A provider does not need to see a Primary Account Number, or PAN, to affect its security. A managed security service provider, cloud provider, identity provider, hosting company, application management provider or remote-support supplier may not handle payment data directly, but its access or services could still affectthe security of systems within scope.

This means the correct question is not simply:

Does this provider handle card data?

It is:

Could this provider’s systems, personnel, access or services affect the security of account data or help us meet a PCI DSS requirement?

When the answer is yes, the relevant services, access paths, system dependencies and provider-managed responsibilities must be considered in the customer’s PCI DSS scope and assessment.

Why “PCI compliant” is not a sufficient answer

PCI DSS compliance applies to a defined scope, service and period.

A provider may operate several products, platforms or service lines. Its Attestation of Compliance may cover one of them but not the service your organisation uses. The assessed scope may be limited to specified legal entities, services, environments, locations, regions or delivery models, as documented in the AOC and supporting assessment materials.

The statement “our provider is PCI compliant” tells you very little on its own.

You still need to determine:

  • Which legal entity was assessed
  • Which services and locations were included
  • Which PCI DSS version was used
  • The assessment completition date
  • Whether the AOC remains current
  • Which PCI DSS responsibilities are assigned to the provider, the customer or both parties; and
  • Whether the service delivered to your organisation matches the service described in the AOC.

Without that analysis, an AOC can create false confidence.

An organisation may possess a valid document while relying on a service that sits outside the provider’s assessed scope.

How can a service provider validate PCI DSS Compliance?

A third-party service provider generally has two routes for validating its PCI DSS responsibilities.

Annual PCI DSS validation

The provider can complete an annual PCI DSS assessment and supply customers with appropriate evidence, normally an AOC.

Depending on its validation requirements, the provider may complete:

  • An SAQ D for Service Providers
  • A Report on Compliance completed with a Qualified Security Assessor

This is usually the most straightforward route for customers because the provider has already identified its scope, assessed the applicable controls and documented the outcome.

However, the customer must still review the AOC carefully. Receiving the document does not remove the need to confirm that it covers the relevant service.

Assessment through the customer’s ROC

Where the provider has not completed its own annual assessment, it may participate in a customer’s PCI DSS assessment.

The provider must make sufficient evidence, personnel, systems and processes available for the customer’s assessor to perform the applicable PCI DSS testing procedures and reach a supported conclusion. The provider’s responsibilities are then evaluated as part of that customer’s Report on Compliance. This is not a simple declaration from the provider. It requires detailed evidence and assessor testing. It is also not an option available to every merchant.

Can an SAQ merchant include a provider in its own assessment?

A merchant cannot use its own SAQ to validate the internal PCI DSS compliance of an unvalidated service provider. The merchant’s SAQ covers the merchant’s eligible environment and the requirements applicable to that merchant.

The merchant should not be required to:

  • Determine the provider’s PCI DSS scope
  • Decide which requirements apply to the provider
  • Examine the provider’s internal evidence
  • Self-assess the provider’s control environment

A provider serving an SAQ merchant is expected to validate its own compliance through an SAQ D for Service Providers or a ROC.

Therefore, when a provider without its own validation tells an SAQ merchant that it can simply be “covered by the customer’s assessment”, the merchant should challenge that position.

The route of incorporating the provider’s controls into the customer assessment applies to organisations completing a ROC and choosing to assess those provider responsibilities directly. It is not a universal alternative to service-provider validation.

 

 

What should you check in a PCI DSS AOC?

An Attestation of Compliance is important evidence, but only when it is reviewed properly.

Checking the provider’s name and assessment completion date is not enough. Your due diligence should confirm that the AOC applies to the service, environment and relationship in question.

Confirm the assessed entity

Check that the legal entity named on the AOC is the entity delivering your service.

Large groups may operate through several subsidiaries. A parent company’s assessment does not automatically cover every subsidiary or regional operation.

Confirm the service is included

Review the description of the assessed services.

The provider may offer multiple cloud environments, hosting services, payment products or managed services. The AOC must cover the specific service you consume, not merely another service supplied by the same company.

Check the assessment date

PCI DSS validation is not permanent.

An AOC should not remain on file indefinitely without confirming whether the provider’s PCI DSS compliance status is still current and whether updated validation documentation is available.

Check the PCI DSS version

Confirm which version of PCI DSS was used during the provider’s assessment.

This helps determine whether the provider’s validation is based on the applicable version of PCI DSS and is suitable for the customer’s assessment and reporting period.

Review the responsibility information

The agreement and supporting documentation should make clear which PCI DSS requirements are:

  • The provider’s responsibility
  • The customer’s responsibility
  • Shared between both parties

An AOC does not transfer every responsibility to the provider. Customers remain accountable for understanding and operating their side of the control environment.

How should Third-Party service providers be reported in a ROC?

Every provider meeting the PCI DSS scoping criteria should be documented in Section 4.4 of the Report on Compliance.

This includes providers that:

  • Store, process or transmit account data
  • Manage systems within the cardholder data environment
  • Provide services used to meet PCI DSS requirements
  • Could affect the security of account data

Where relevant, the provider’s services, connections, access and dependencies should also be reflected in the ROC sections addressing scope, system components, network connections, segmentation, data flows and assessed locations.

The important point is consistency.

The providers listed in the ROC should align with:

  • The systems and services included in scope
  • The organisation’s data-flow diagrams
  • Its network diagrams
  • Its third-party inventory
  • Written agreements
  • Responsibility matrices
  • The evidence reviewed during the assessment

A provider should not appear in one document but disappear from the others.

What does “in place” mean for provider-managed requirements?

When a third-party provider is responsible for a PCI DSS requirement, the requirement may be reported as “In Place”.

But that conclusion requires supporting evidence.

The assessment documentation should identify:

  • The provider responsible for the requirement
  • The written agreement assigning that responsibility
  • The AOC reviewed by the assessor
  • The AOC date and PCI DSS version
  • The outcome of the provider’s assessment
  • Confirmation that the AOC covers the service used by the customer
  • The assessment procedures supporting the conclusion

“In Place” is not shorthand for “the supplier told us it was compliant”.

It is a documented assessment conclusion supported by contracts, validation evidence and testing.

Where those elements are absent, the finding may not be defensible.

What does PCI DSS Requirement 12.8 require?

PCI DSS Requirement 12.8 addresses how organisations manage third-party service providers that have access to account data or could affect its security.

It requires organisations to maintain oversight of the relationship rather than treating provider assurance as an annual document-gathering exercise.

Maintain a complete provider inventory

Requirement 12.8.1 requires a list of relevant third-party service providers, including a description of the services each provider delivers.

That inventory should reflect the current cardholder data environment. It should be updated when services are introduced, changed or retired.

Put written agreements in place

Requirement 12.8.2 requires written agreements with applicable providers.

These agreements should acknowledge the provider’s responsibility for protecting account data or for the PCI DSS requirements it manages on the customer’s behalf.

Vague contractual language can lead to uncertainty over who is responsible for particular controls.

Conduct due diligence before engagement

Requirement 12.8.3 requires organisations to maintain a process for engaging service providers, including appropriate due diligence before the relationship begins.

PCI DSS considerations should therefore form part of procurement and onboarding, not be addressed only when the annual assessment starts.

Before signing a contract, organisations should understand:

  • Whether the provider will be in scope
  • How it validates PCI DSS compliance
  • What evidence it will provide
  • Which controls it will operate
  • What responsibilities remain with the customer
  • How changes to scope or compliance status will be communicated

The depth of due diligence should be proportionate to the service, access, data handled, technical dependencies and potential impact on the CDE.

Where Third-Party PCI DSS compliance commonly breaks down

Most third-party findings are not caused by organisations having no documentation at all.

They are caused by documentation that looks adequate until someone examines it closely.

The provider’s validation is no longer current

An older AOC remains in the compliance repository, but nobody has checked whether the provider completed its latest assessment.

The AOC covers a different service

The document is valid, but it relates to another product, hosting model, location, region or legal entity.

The provider inventory is outdated

The organisation’s third-party list no longer matches its current systems, integrations, payment flows or cloud services.

Responsibilities are unclear

The customer assumes the provider manages a control, while the provider’s documentation states that the customer remains responsible.

“In Place” findings have no evidence trail

Requirements are marked “In Place” based only on the provider’s reported status, without identifying the applicable service, responsibility allocation, validation evidence or testing supporting the conclusion.

An SAQ merchant tries to assess the provider

The provider has no independent validation and expects the merchant to include its controls within an SAQ, despite the merchant not being responsible for assessing the provider’s environment.

These gaps often remain hidden until the formal assessment is underway. At that stage, resolving them can involve chasing suppliers, reviewing contracts, redefining scope and collecting evidence under considerable time pressure.

How to strengthen PCI DSS third-party Due Diligence

Effective third-party management requires a repeatable process that connects procurement, legal, information security, payments teams and compliance.

Start by building a complete inventory of providers that either handle account data or could affect its security. Map each provider to the service it supplies, the systems it can access and the relevant PCI DSS requirements.

For every in-scope provider, obtain current validation evidence and confirm that it covers the service you use. Document which controls the provider manages and which remain your responsibility.

That review should not happen once and then be forgotten. Provider services change. Contracts change. Platforms migrate. A provider may alter its assessed scope or replace one service with another.

A mature process therefore includes:

  • Due diligence before onboarding
  • Contractual allocation of responsibilities
  • Initial review of PCI DSS evidence
  • Regular checks on AOC validity
  • Reassessment following material service changes
  • Defined escalation where evidence is missing or inadequate
  • Removal of retired providers from the PCI DSS scope and inventory

The objective is not merely to collect documents. It is to establish that the provider’s controls, responsibilities and validation support your own PCI DSS compliance.

How Integrity360 can help

Third-party service providers can significantly complicate PCI DSS scoping and assessment, particularly where responsibilities are shared across several suppliers, platforms and internal teams.

Integrity360’s Payments Compliance specialists can help organisations:

  • Identify third parties that belong within PCI DSS scope
  • Review AOCs and supporting compliance evidence
  • Confirm whether validation covers the services being consumed
  • Assess responsibility matrices and contractual arrangements
  • Prepare TPSP scope, responsibility and evidence information for inclusion in a ROC
  • Review processes supporting Requirement 12.8
  • Identify evidence gaps before the formal assessment begins
  • Build a more sustainable PCI DSS compliance programme

Integrity360 has delivered payment security assessment services since 2009 and supports organisations across PCI DSS, 3DS, P2PE, Secure Software Framework, Token Service Provider, PIN Security and Card Production and Provisioning requirements.

Do not stop at “PCI Compliant”

A provider’s PCI DSS status matters, but it cannot be accepted without context.

You need to know what was assessed, when it was assessed, which services were included and whether the provider’s responsibilities are clearly supported by contracts and evidence.

An AOC on file is useful.

An AOC that is current, relevant and applicable to the correct service can support a defensible PCI DSS assessment when it is considered together with the responsibility allocation, contractual commitments, customer-side controls and applicable testing evidence.

Speak to Integrity360 to review your third-party service provider scope, validate your evidence and prepare for your next PCI DSS assessment.