Template
MSP PCI responsibility matrix.
PCI DSS requirement 12.8.5 expects merchants to know which requirements each service provider manages. Use this example as a starting point and agree your own in writing.
Example: a small e-commerce merchant on a hosted payment page, whose MSP manages its network, endpoints and website hosting. Your split will differ.
| PCI DSS requirement | MSP | Merchant | Processor / gateway |
|---|---|---|---|
| 1. Network security controls | Firewall and router configuration for the merchant's network | Approves changes | Its own environment |
| 2. Secure configurations | Hardening of managed devices and servers | Approves exceptions | Its own environment |
| 3. Protect stored account data | Confirms no card data is stored on managed systems | Doesn't store card data | Stores and protects card data |
| 4. Encrypt transmission | TLS on managed systems and website | — | Encrypts its payment form and APIs |
| 5. Anti-malware | Deploys and monitors endpoint protection | Reports suspicious activity | Its own environment |
| 6. Secure systems and software | Patching; payment page scripts (6.4.3) if it manages the website | Approves website changes | Its hosted payment page |
| 7. Restrict access by need to know | Implements roles on managed systems | Decides who needs access | Its own environment |
| 8. Identify users and authenticate | MFA and unique accounts on managed systems | Uses them | Its own environment |
| 9. Physical access | — | Secures terminals and paper | Its data centres |
| 10. Logging and monitoring | Collects and reviews logs on managed systems | — | Its own environment |
| 11. Test security regularly | Vulnerability scans; change detection (11.6.1) if it manages the website | Arranges ASV scans if required | Its own environment |
| 12. Policies and programs | Security policy input; incident response support; its own AOC | Owns the policy, signs the SAQ, maintains the provider list (12.8) | Provides its AOC and responsibility statement |
How to use it
- Copy the table into your statement of work and edit each cell for the actual service.
- Mark each requirement as MSP, merchant, provider or shared, and say who does what when it's shared.
- If your services can affect the security of the merchant's cardholder data environment, plan for your own service provider assessment and AOC. See does your MSP need a PCI AOC?
- Review it every year, and whenever the merchant changes how it takes payments.
This is an example, not legal or QSA advice. Requirement numbers refer to PCI DSS v4.0.1.
Protect your merchants' checkout before the next attack.
Join the CardSecurity pilot for managed service providers. 30-day trial, up to 5 merchants.