What does Req 12.8.3 require before engaging any service provider?

• A. Not required
• B. Simple onboarding
• C. Documented policies and procedures including proper due diligence prior to engaging any service provider
• D. Sign after service

Answer: (C)

Before engaging any service provider, you must have documented policies and procedures that require proper due diligence. This means you actively assess the provider’s security controls, data handling practices, PCI DSS compliance, and risk before you onboard them. Having these formal policies ensures you verify the provider’s ability to protect cardholder data, define clear contractual protections and responsibilities, and set up ongoing monitoring and review. Engaging a provider without this pre-engagement due diligence increases risk, and onboarding or signing after the fact doesn’t establish the necessary safeguards in advance.