For service providers only, what must the written agreement confirm regarding PCI DSS obligations?

• A. They are exempt from PCI DSS
• B. They will maintain all applicable PCI DSS requirements to the extent they possess or store, process or transmit cardholder data on behalf of the customer, or to the extent that they could impact the security of the customer's cardholder data environment.
• C. They provide monthly reports
• D. They don't have to acknowledge

Answer: (B)

The main idea is that a service provider’s written contract must explicitly bind them to PCI DSS obligations. The contract should confirm that the service provider will maintain all applicable PCI DSS requirements for any cardholder data they possess, store, process, or transmit on behalf of the customer, and for any controls they must implement if their activities could affect the security of the customer’s cardholder data environment. This ensures accountability and clear security responsibilities when data or systems are outsourced.

Why this is best: it covers both direct handling of cardholder data and any impact on the customer’s security posture, which is the core purpose of the PCI DSS requirements for service providers. The other options don’t reflect the contractual obligation to uphold PCI DSS; an exemption isn’t accurate, monthly reports aren’t the mandated contract content, and simply not acknowledging obligations would leave security responsibilities unclear.