PCI DSS Outsourcing
Definition
PCI DSS Outsourcing
PCI DSS outsourcing is the practice of placing card payment work with a provider that meets the payment card industry security standard. Compliance does not transfer with the work, so a buyer using a compliant provider still demonstrates its own.
This is the misunderstanding that costs merchants the most money.
Using a compliant provider reduces what you have to prove — it does not remove the obligation, and it does not make your environment compliant by association.
What a provider’s compliance genuinely gives you is the ability to stop testing the parts it runs — provided you can document exactly where its responsibility ends and yours begins.
Key takeaways
- A provider’s compliance reduces your testing scope; it does not replace your obligation.
- The responsibility matrix defines which requirements each party operates.
- An attestation of compliance lets your assessor rely on the provider’s own testing.
- Service providers are assessed at levels, with Level 1 the most rigorous.
How it works
The standard is maintained by the PCI Security Standards Council, founded in 2006 by American Express, Discover, JCB International, MasterCard and Visa. The council also validates the assessors who perform testing.
Two roles matter when work is outsourced. Qualified Security Assessors conduct assessments; Approved Scanning Vendors run the external scans. Both are validated by the council rather than self-declared.
Scope is the whole game. Every system that stores, processes or transmits cardholder data falls inside it, along with anything connected to those systems.
Outsourcing shrinks that footprint when it is done properly. Push card data to a compliant payment provider and your own systems may never touch it, which removes them from scope entirely.
The limit is explicit. AWS states that customers must manage their own PCI DSS compliance certification, and additional testing will be required to verify that your environment satisfies all PCI DSS requirements.
What you gain is reliance. AWS notes that a Qualified Security Assessor can rely on the AWS Attestation of Compliance (AOC) without further testing of the provider’s own infrastructure.
| Document | What it does for you |
|---|---|
| Attestation of compliance | Lets your assessor rely on the provider’s testing |
| Responsibility matrix | States which requirements each party operates |
| Scope diagram | Shows where cardholder data actually flows |
| Assessor report | The underlying detail behind the attestation |
| Service provider level | Indicates the rigour of the provider’s own assessment |
Get the responsibility matrix before signing. Requesting it afterwards turns a contractual question into a negotiation.
Examples
Card data has a way of appearing in places nobody designed for it, and outsourced operations are where it usually happens. The four cases below are unremarkable, which is exactly why they repay attention.
A retailer routes payments through a compliant gateway and removes its own servers from scope. That is outsourcing working exactly as intended.
A contact centre records calls in which customers read out card numbers. Those recordings are cardholder data, and the data center outsourcing arrangement storing them is now in scope.
A merchant assumes its provider’s compliance covers it entirely. Its own assessment fails on requirements the provider never operated, an outcome compliance outsourcing teams see repeatedly.
A buyer asks for the responsibility matrix and finds eighteen requirements marked shared. Shared means both parties do something, and neither had been told which part.
Related terms
Payment security terminology spans a standard, a status, a service line and a role, which buyers merge into one idea. Each line below draws a single meaning and an edge in the same breath.
- PCI DSS: the standard itself, considered apart from any outsourcing arrangement.
- PCI compliance: the state of meeting it, which is assessed rather than purchased.
- Cybersecurity outsourcing: buying security operations, broader than card data protection.
- Compliance outsourcing: delegating regulatory work, which does not delegate the obligation.
- Information security analyst: the role operating the controls the standard requires.
- Vendor management outsourcing: running supplier assurance, including collecting attestations annually.
- Data center outsourcing: the hosting arrangement that frequently sits inside cardholder scope.
FAQ
Does using a compliant provider make me compliant?
No. It reduces the scope you must test and lets your assessor rely on the provider’s attestation, but your own compliance is still assessed separately.
What is an attestation of compliance?
A signed document confirming a provider was assessed and found compliant. Your assessor can rely on it instead of retesting the provider’s infrastructure.
What is a responsibility matrix?
A mapping of every requirement to the party that operates it — provider, customer, or both. It is the single most useful document in the pack.
Are call recordings in scope?
If they contain card numbers, yes. Recorded customer service calls are a common and frequently overlooked source of cardholder data.
What are service provider levels?
Tiers determining assessment rigour based on transaction volume, with Level 1 requiring the most thorough independent assessment.
Which version is current?
Version 4 is the current family of the standard, published by the PCI Security Standards Council and maintained through point releases.
Search verified partners in the Outsource Accelerator directory and get the responsibility matrix in writing before signing.
Independent
