Often yes, if they share account data with you or could affect the security of that data. PCI DSS 12.8.1 asks for a list of third-party service providers (TPSPs) in either group, with a description of each service. Written agreements, due diligence and annual monitoring follow. Using a compliant provider does not make you compliant. This is not legal advice.
Definition and test
TPSP: a third party that shares account data with you or could affect the security of account data or the CDE.
The test in 12.8.1 has two prongs: account data is shared with it, or it could affect security of account data. A hosting platform, a payment gateway, a checkout script provider and a managed firewall service can all meet the second prong even if they never see a card number.
What each 12.8 item asks
| Item | Requirement |
|---|---|
| 12.8.1 | Maintain a list of TPSPs with a description of each service |
| 12.8.2 | Written agreements in which TPSPs acknowledge responsibility for the security of account data they hold or that they could affect |
| 12.8.3 | A process for engaging TPSPs, including due diligence before engagement |
| 12.8.4 | A program to monitor TPSP compliance status at least every 12 months |
| 12.8.5 | Information on which PCI DSS requirements each TPSP manages, which you manage, and which are shared |
The note on 12.8.1 says use of a PCI DSS compliant TPSP does not make you compliant or remove your responsibility. The note on 12.8.2 says evidence such as an Attestation of Compliance or a website declaration is not the same as the written agreement.
A starter register
| Column | Example content |
|---|---|
| Provider | Name |
| Service | What it does for you |
| Data shared | Card data, none but affects security, etc. |
| Agreement | Link and date |
| Compliance evidence | What you collected and when |
| Responsibilities | Who covers which requirements |
| Next review | Within 12 months |
Where developers come in
Developers add the dependencies. Ask engineering to flag any new vendor SDK, script or service that touches a payment flow before it ships, so the register stays accurate. Open source packages are components, covered by the software inventory, rather than providers you contract with, though a hosted service built on one may be a TPSP. Confirm edge cases with your assessor.
Quick check
If my processor is PCI compliant, am I covered?
No. The note says it does not make you compliant or remove your responsibility.
Is an AOC the same as a written agreement?
No. The 12.8.2 note says they are different things.
On Safeguard: asset discovery and compliance and evidence automation help keep inventories and dated evidence, including vendor records. Try the free scan at gold.safeguard.sh/scan.
Sources
Wording is from v4.0. Confirm in the current version.
Last reviewed: 19 October 2026.
