PCI DSS Service Provider Questionnaire — 25 questions merchants ask before sharing CHD

1. 1.1
   Provide current PCI DSS Attestation of Compliance (AOC) — service provider type, validated version (4.0 / 4.0.1), assessor name, validation date.
   Critical
2. 1.2
   Are you Level 1 or Level 2 service provider? Annual transaction volume processed on behalf of merchants?
   High
3. 1.3
   Provide the Responsibility Matrix (Appendix A in your AOC) — which controls are managed by you vs the customer?
   Critical
4. 1.4
   Will you supply a copy of the Report on Compliance (ROC) under NDA on request?
   High

1. 2.1
   Describe the data flow from merchant to your CDE — which data elements (PAN, CVV, expiry, name) are captured, in what form (raw, tokenised, encrypted)?
   Critical
2. 2.2
   How is the CDE segmented from non-CDE networks? Provide the segmentation test report (Req 11.4.5).
   Critical
3. 2.3
   Is SAD (Sensitive Authentication Data) ever stored after authorisation? It must not be (Req 3.2.1).
   Critical

1. 3.1
   PAN encryption at rest — algorithm, key length, key management provider, HSM type. Confirm Req 3.5 compliance.
   Critical
2. 3.2
   PAN transmission over open networks — TLS version, cipher suites, certificate authorities (Req 4.2).
   Critical
3. 3.3
   Key custodian dual control, split knowledge, key rotation cadence (Req 3.6).
   High
4. 3.4
   Is tokenisation offered? If yes, where do raw PANs land and how long are they retained pre-tokenisation?
   High

1. 4.1
   MFA enforced for all administrative CDE access and all non-console access (Req 8.4 / 8.5)?
   Critical
2. 4.2
   Audit logs of all CDE access — retention minimum 1 year, 3 months immediately accessible (Req 10.5)?
   Critical
3. 4.3
   Log review process — daily for critical assets (Req 10.4)? SIEM or manual?
   High

1. 5.1
   ASV scans quarterly (Req 11.3.2) — provide the most recent passing scan certificate. ASV name?
   Critical
2. 5.2
   Annual internal and external penetration test (Req 11.4) — most recent date, provider, executive summary?
   High
3. 5.3
   Secure SDLC — Req 6.2 / 6.3 controls (training, SAST, code review, change management).
   High

1. 6.1
   Documented IR plan tested annually (Req 12.10.2)? Provide last test date and outcomes.
   High
2. 6.2
   Maintain a list of all TPSPs (Req 12.8.1) with their PCI DSS responsibility and AOC status?
   Critical
3. 6.3
   Written agreements with TPSPs acknowledging responsibility for the CHD they handle (Req 12.8.2)?
   High

Run a free PCI DSS 4.0.1 audit. ComplianceIQ uses your audit responses and generated policies to populate an answer pack you can paste into any SIG, CAIQ, or custom enterprise questionnaire — in minutes, not days.