When you outsource your billing to a third party, it may give the impression that the associated risk is also being outsourced, but this is not the case. If that vendor has access to cardholder data and is breached, your organization is on the hook whether you had any direct control over their compliance programs or not.

Outsourcing billing doesn’t outsource liability

Many procurement teams assume that a vendor’s PCI DSS badge is equivalent to a business license – just show it and move on. However, this is a flawed strategy. The Payment Card Industry Data Security Standard applies to all entities that store, process, or transmit cardholder data. Engaging a service provider to process card data does not exclude you from the Cardholder Data Environment – it simply makes you in-scope within a different role.

If your payment service provider is breached, your customers’ card data is still compromised, your brand reputation is damaged, your acquiring bank will be at your door demanding to know your compliance status with PCI DSS – not just your provider’s. Regulators and card brands are not interested in how many links were in the chain, they simply want to know if the data was secure. This is the reason vendor risk management exists – because contracts and website marketing material don’t provide that assurance. Only paperwork and evidence do.

Read the actual attestation, not the badge

Any vendor worth their salt can send over a summary report of how they did on the latest audit, and you’re looking for a few things when you read it:

  How many issues did they have? Every audit turns up something, and low double-digit totals are normal. A single high-severity issue is often more worrying than ten low-severity ones, as it implies something fundamental about what was assessed. Asking for the results doesn’t require you to understand the minutia of every point – one goal of the exercise is to see how openly your vendor communicates and how directly they answer a question that’s a matter of public record. So if all you get is a spreadsheet, you’re perfectly entitled to bounce it back with, “Can you summarize your current and past state against me and show progress?”

  Have any prior issues recurred? If a vendor has had a year to fix a problem and they still can’t, that might be interesting to you.

  What did the assessor have to say about the observance and quality of management responses? An experienced assessor can pinpoint where internal teams are prodding things with a stick and tying themselves in knots to band-aid over a deep flaw.

Don’t mystify the whole process, though. PCI doesn’t magically protect your customers’ information from all dangers, and “don’t blindly trust partnerships” is a basic fact of running a business. Anyone can fill out an SAQ or hire a QSA to sign off, and even a perfect ROC guarantees little. Understanding how a formal pci compliance audit is structured – what systems get reviewed, how scope gets defined, what evidence a QSA collects – makes it easier to spot when a vendor’s documentation is thin or scoped to cover only part of what they’re selling you. What differentiates a good fit is how open, straightforward, and coherent with the facts you feel your vendor is when talking about all of this.

Build a shared responsibility matrix before you sign anything

Achieving PCI DSS compliance cannot solely depend on the vendor or your efforts entirely. There should be a clear split that is documented. For instance, your vendor may manage the physical security of the server, encryption at the database level, and network segmentation. But, you are likely required to manage user access controls, ensure the secure configuration of any systems that may be integrated, and address how your staff manages cardholder data up to the point of transfer to the vendor’s system.

Ask if the vendor is using tokenization to swap card numbers with non-sensitive tokens after import. If they offer point-to-point encryption starting at card swipe. Both of these can minimize the amount of your environment that counts and thus reduces your audit and risk, but again, you can’t let that be a vague promise; get a spreadsheet that maps systems and responsibilities to specific PCI DSS requirements.

Ask for proof, not promises, on ongoing monitoring

Think about it this way: An annual audit is a snapshot. Threats don’t wait a year between attempts. Only 27.9% of organizations worldwide maintain full, active PCI DSS compliance between their annual assessments (Verizon), which means compliance drift between audits is the norm, not the exception.

Ask your vendor for evidence of quarterly external vulnerability) scans run by an Approved Scanning Vendor. Ask about annual penetration testing results, not just a summary saying “passed.” Ask what continuous monitoring looks like day to day, and whether they’d notice a misconfiguration before it turned into an incident. If a vendor can’t produce recent scan reports on request, treat that as a red flag worth escalating, not a minor gap.

Put teeth into the contract

Making sure the companies you do business with are actually following the rules, on paper and in practice. Including terms in your contracts that give you the right to independently assess your vendors’ security measures, as well as a timely notice if they’re breached or their compliance falters, can help you sleep better and avoid surprises at three in the morning. Spell out what happens if their PCI status lapses mid-contract. Vague language here tends to surface exactly when you need it most.

Act like the auditor, not the customer

Companies offering billing infrastructure for sale will do their best to present compliance as a closed issue that poses no problems. In reality, this is hardly the case. You need to double check every assertion, make sure every certificate is still valid, and assess every individual integration as a new compliance-related problem. The most effective way to get in trouble is to trust a badge without verifying the documentation that supports it.

The post How to Verify the Security Compliance of Your Third-Party Billing Vendors appeared first on The Next Hint.