First decide whether you are a third-party service provider for that customer, because that decides which questions apply. If you store, process or transmit account data, or can affect its security, answer with scope, a shared responsibility split and evidence. Never imply a PCI attestation you do not hold.
Why do you get PCI questions at all?
The PCI Security Standards Council publishes PCI DSS, and its document library lists v4.0.1 among its featured documents. Customers who handle card data must manage the vendors that touch it. Requirements 12.8 and 12.9 deal with third-party service providers, per PCI SSC FAQs and secondary guides. We could not retrieve the standard's own text for those requirements, so check the exact wording in the PDF before you rely on a detail.
Are you a third-party service provider?
PCI SSC FAQ 1427, last updated November 2025, gives a practical test for OEMs and resellers. If they only provision equipment, or only supply a product and are not involved in its day to day operation, they are not service providers for 12.8 and 12.9. If they provide continuing support, help run the equipment or software, or have access to the customer's cardholder data environment, they are.
The same logic helps a software vendor. A tool that never touches card data or the environment that holds it is usually outside the scope of those requirements. A tool that can reach it may not be. Ask your assessor, and write the answer down.
What does a good answer contain?
Scope. State which of your services, if any, store, process or transmit account data, or can affect its security. Say "none" plainly if that is true.
Responsibility. Describe who handles each requirement, in a short table or list. Customers often ask for a responsibility matrix.
Evidence. Name the document you will share: an attestation of compliance if you have one, a dated policy, a test report. A secondary guide describes 12.9.1 as a written acknowledgment from a provider to its customers that it is responsible for the security of account data it handles for them. Only give that acknowledgment if your legal team approves it.
Honesty. If you are not assessed, say so, and say what you do instead.
What to avoid
Do not write "PCI compliant" as a badge. Do not say you hold a validation you do not hold. Do not say a tool makes the customer compliant. Safeguard does not certify anyone for PCI DSS.
What to do
- Decide with your assessor or counsel whether you are a third-party service provider for each customer.
- Draw the data flow: where account data, if any, enters, is stored and leaves.
- Write one scope statement per service and keep it in a master answer file.
- Build a short responsibility matrix, then review it with the customer.
- Gather dated evidence and note who owns each document.
- Reuse the master answers for every questionnaire, and log changes.
- Have a second person check each answer against the evidence.
Where does tooling help?
Dependency inventories and vulnerability findings support answers about vulnerability management and software components. Safeguard generates SBOMs and runs scans, and these can supply evidence for such questions. They are not a PCI assessment.
Quick check
Is PCI DSS 4.0.1 a new standard?
PCI SSC lists v4.0.1 among its featured documents and links a summary of changes from v4.0. Read that summary for the differences.
What if we never touch card data?
Say so, show the data flow that supports it, and note the services that stay out of scope.
Sources
- PCI Security Standards Council, Document Library
- PCI SSC FAQ 1427, OEMs and resellers and requirements 12.8 and 12.9
Last reviewed: 18 October 2026.
