Apparently there are a lot of newcomers to the PCI compliance business and are asking bizarre questions regarding PCI. One of the most common is if their organization is a merchant or a service provider or both?
Merchant
According to the PCI DSS v3 Glossary, a merchant is defined as:
“For the purposes of the PCI DSS, a merchant is defined as any entity that accepts payment cards bearing the logos of any of the five members of PCI SSC (American Express, Discover, JCB, MasterCard or Visa) as payment for goods and/or services. Note that a merchant that accepts payment cards as payment for goods and/or services can also be a service provider, if the services sold result in storing, processing, or transmitting cardholder data on behalf of other merchants or service providers. For example, an ISP is a merchant that accepts payment cards for monthly billing, but also is a service provider if it hosts merchants as customers.”
One of the points that create some of the most confusion is the point made at the end of the merchant definition that it is possible for a merchant to also be a service provider. A lot of people think that this is a black or white, either or type of situation which it is not.
The key thing to determining if your organization is a merchant is if your organization signed a merchant agreement with a bank and has a merchant account with that bank. If your organization did, then you are definitely a merchant.
Service Provider
Now let us talk about service providers. In the same document, a service provider is defined as:
“Business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This also includes companies that provide services that control or could impact the security of cardholder data. Examples include managed service providers that provide managed firewalls, IDS and other services as well as hosting providers and other entities. If an entity provides a service that involves only the provision of public network access—such as a telecommunications company providing just the communication link—the entity would not be considered a service provider for that service (although they may be considered a service provider for other services).”
The first thing to remember about service providers is that you can be tagged as a service provider and not be directly processing, storing or transmitting cardholder data (CHD) or sensitive authentication data (SAD). We see this most often with organizations that provide managed security services (MSS). In most cases, these organizations manage/monitor the devices that provide and/or secure the communications links. As a result, these MSS providers can have access to unencrypted CHD/SAD whether they realize that or not. If the MSS could be in contact with unencrypted CHD/SAD via the devices they manage, then they are in-scope for PCI compliance.
I can tell you from personal experience that service providers that are not directly processing, storing or transmitting CHD/SAD will push back and fight very hard to be ruled out of scope for PCI compliance. It has gotten to the point that I have seen and heard of service providers taking customers to court for misrepresenting their business and to force their customer out of their service contract. In the majority of the cases I am aware; it was shown that it was the service providers’ negligence from not explicitly asking whether or not PCI compliance was required by the customer. So if you need to be PCI compliant, it is very important to make that clear to any service provider you are looking at just in case one or more of their services could come into contact with CHD/SAD.
Another way an organization can become a service provider is when they conduct card transactions on behalf of a third party. The best example of this situation is with outsourced call centers. While the call center might be conducting the card transactions on your systems, they are a third party that is processing and transmitting CHD/SAD through their workstations for your organization. As a result, the call center is a service provider and is in-scope for PCI compliance.
Another way an organization can become a third party is if they are conducting transactions through their systems using a merchant account of a third party. I have encountered this with call centers where the call center is using their own applications, but the merchant account used to process payments through is not the call center’s merchant account, it is the merchant account of the call center’s customer.
Both?
Finally, there is the example from the Merchant definition where the organization is both a merchant and a service provider. As pointed out in the definition, this most commonly occurs with Internet service providers (ISP) and shared hosting providers that provide not only services for hosting a customer’s IT environment, but then accepts cards for payment for those hosting services. From the hosting perspective, these organizations are a service provider and must comply with the PCI DSS for those services provided to their customers. However, these organizations are also merchants because their customers can pay using a credit/debit card.
Some Closing Comments
Before I finish this post, I also want to add some comments regarding compliance reporting for service providers.
The first comment I would like to make is regarding reporting and compliance testing. If you are a service provider, you only have the choice of a Self-Assessment Questionnaire (SAQ) D or a Report On Compliance (ROC). If your organization processes, stores or transmits less than 300,000 card transactions, then you can use either the SAQ D or perform a ROC. If your organization processes, stores or transmits 300,000 or more card transactions, then you are required to do a ROC.
If you are an ISP, MSS or similar service provider that does not process, store or transmit CHD/SAD, then you will not have a transaction count and therefore will fall on the under 300,000 transaction count rule.
Why would an organization that can do an SAQ D do a ROC? If an organization desires to be listed on the Visa Global Registry of Service Providers or the MasterCard PCI Compliant Service Provider lists, then the service provider must do a ROC. There are rules and fees for being included on these lists that each card brand Web site documents. A knowledgeable QSA can help facilitate your listing on these sites as well as conducting the requisite ROC assessment.
A quick side note regarding Visa and service providers. Visa is conducting a separate service provider inventory program that is outside of their Global Registry program. This new inventory process has confused a lot of service providers and QSAs alike including yours truly. For about the last year or so, Visa has been “registering” all service providers in an attempt to create a complete inventory of service providers. This service provider inventory program has nothing to do with the Visa Global Registry and does not put any organization that is processed through it on the Visa Global Registry.
It is very important for service providers to know that the Attestation Of Compliance (AOC) form for the service provider is very different from the merchant version of the AOC. The AOC for service providers provides a list of the services provided by the service provider that were assessed for the AOC. This information is necessary for customers to know if all of their services were assessed for PCI compliance. If a service was missed, then the merchant is responsible for assessing that service for PCI compliance. So it is very important that you ensure that all services provided to your customers that require PCI compliance be assessed for PCI compliance.
Then there are the number of times I have received an AOC from a service provider only to find that it is a merchant AOC, not a service provider AOC. With v3 of the PCI DSS, the Council has created separate SAQ D forms for merchants and service providers that will hopefully cure some of this issue. It is incumbent on service providers to make sure that when they sign the AOC that it is a service provider AOC and all of the services are listed. If not, then you need to go back to your QSA and get the right AOC form with the right information created.
And finally, my biggest pet peeve with service provider AOCs. Some QSACs create these wonderful “Certificates Of PCI Compliance” that, while they look really nice, have no meaning to your customers and their QSAs. No matter how many times the PCI SSC has stated that the only officially recognized document out of a PCI assessment is the AOC, I still encounter these certificates as “proof” of PCI compliance. When asked to provide the AOC, I then get the indignant response that I should have everything I need. In one case, I was even told I could not possibly be a QSA because I did not recognize the certificate as proof of compliance.
As I stated earlier, the service provider AOC is required to ensure that all service provided were assessed and QSAs are required to have copies of all service provider AOCs in order to show that all third parties have been officially assessed for PCI compliance. No AOC means that the service provider is not PCI compliant and must be assessed as part of the customer’s PCI assessment.
I hope we are all now on the same page regarding the concepts of a merchant and a service provider.
Discover more from Core-Infosec
Subscribe to get the latest posts sent to your email.
