Third-Party Vendor Security and PCI DSS

Michael Peters

9 months ago

We’ve regularly written about maintaining security and compliance with third-party vendors. While vendors and managed service providers are a crucial part of digital economies, it’s up to the client businesses to ensure they work with vendors that meet their needs.

Following previous discussions of third-party vendor security under standards like SOC 2 and HIPAA, we’re now covering best practices for vendor management under PCI DSS 4.0.

Changes Under PCI DSS 4.0

PCI DSS defines an industry standard for securely handling and processing cardholders’ information. The latest version, PCI DSS v. 4.0, brings several enhancements in terms of added security for modern systems and a deeper understanding of the complex networks that most businesses work within. It also offers greater flexibility to organizations as they work toward compliance through customized approaches.

Some of the critical areas touched on with the new 4.0 update include;

Stronger authentication requirements
New security measures around modern technologies like e-commerce websites, mobile devices, and app-based purchasing
More requirements for complex encryption and protection requirements for stored cardholder data
Changes to how primary businesses work with service providers and vendors

It is the last of these that we’ll focus on here.

Role of Third-Party Vendors in PCI Compliance

Unlike old-school, massive corporations, modern businesses are small, agile, and reliant on third-party providers to handle security, storage, and data processing. These vendors, from payment processors to cloud service providers, are core to the operational efficiency and security posture of organizations dealing with cardholder data.

Unfortunately, third-party vendors are a high-security risk to any organization, as a single vulnerability in the third-party system can give the hacker access to critical data–a breach of PCI DSS that could have massive consequences for a business. Some of these risks include:

Inadequate data protection
Lack of engagement with modern security standards defined under PCI DSS,
Lack of incident response
No attention to security risks between clients and primary services that could affect multiple businesses
No standardized policies or procedures for managing security in a way compliant with PCI DSS and other client needs

Under PCI DSS, hiring organizations are responsible for ensuring that their vendors act as per the standards of PCI DSS 4.0, meaning that comprehensive vendor management and proper oversight are required.

This process isn’t without its challenges, however, which include:

Cost: Maintaining PCI compliance is costly, especially with a vendor in tow. The cost ratio is better than fielding payment infrastructure in-house, but additional security overhead should be expected.
Mapping Scope of Compliance: Businesses must determine the scope of compliance under PCI DSS requirements for a third-party vendor. Conversely, vendors must understand which services and processes fall under PCI DSS scope and ensure that relevant areas are compliant.
Maintaining Documentation: Organizations must ensure that the vendors provide proper documentation on their compliance. This is not a simple practice but a necessary one in a world of constantly changing security threats and requirements.
Risk Management and Incident Response: Organizations must incorporate additional risk management capabilities to manage the risks introduced by sharing data and access with a third-party vendor.
Vendor Relationship Management: Vendor management is a discipline in itself. Such management will include people and resources to manage and maintain, which can cause additional overhead that a business may not have expected.
Technical and Operational Integration: Tech integration is complex, costly, and an ongoing security threat. Additional requirements will include configuring services to ensure that they meet security requirements, securing data transfers, and controlling access..

How Can My Business Manage Vendor Compliance for PCI DSS?

Maintaining PCI DSS 4.0 compliance with third-party vendor relationships is a comprehensive exercise involving ongoing oversight and effective communication. These continuous processes will extend over several business capabilities and processes.

Some best practices to consider include:

Evaluate Vendor Compliance: Have a structured evaluation of vendor compliance with the standard PCI DSS 4.0 before engaging with any of them.
Implement Robust Risk Assessment: Conduct a risk assessment exercise to understand the risks a vendor might carry about your payment card data environment as per PCI DSS 12.2. Among the essential capabilities to analyze are the vendor’s access to your data, their possible involvement in processing or storing payment card information, and the degree to which the firm has controls in place to secure such information.
Contractual Agreements: Maintain well-defined, comprehensive, and regularly updated contract terms for vendors and vendor management policies. Contractual terms include assessments and documentation (where relevant), strict compliance requirements, reporting requirements, and breach notification obligations. PCI DSS 12.9 specifies compliance requirements for contractual agreements.
Data Flow Analysis: Map and document payment card data flow into and out of the organization about the vendor. This will help identify the vulnerability and ensure that your data is encrypted and securely transmitted.
Access Control: Restrict the vendor’s access to the payment card data only on a “need-to-know” basis related to provided services. Apply strict access controls and monitor their activities.
Ongoing Regular Audits and Assessment: Include ongoing regular audits of vendor processes and systems to ensure compliance with PCI DSS 4.0. This process may include self-assessments as well as those by independent third parties.
Compliance Reports: Regularly Request compliance reports detailing the findings of internal audits, research penetrations, and vulnerability scans.
Incident Response Planning: Develop and coordinate incident response planning with third-party service providers. Require third-party service providers to agree to give real-time notification of security incidents or breaches. PCI DSS 12.10 specifically references expectations of incident response planning.
Vendor Training: Provide or require vendor training on PCI D4.0 standards according to the specific security policies and procedures that apply within your organization. While there is no requirement for this particular training, PCI DSS 12.6 specifies an overall focus on training that, under best practices, could extend to vendor support.
Performance and Compliance Review: There should be a periodic review of a vendor’s performance and compliance status. Included therein is the reassessment of the risk profile, coupled with changes in their business practices or the service delivery that can impact PCI DSS compliance.

Streamline Vendor Security Management with Lazarus Alliance

Contact a team member to learn how we can help you streamline vendor security and management for PCI DSS or other compliance frameworks.

[wpforms id=”137574″]