What information must be maintained to map PCI DSS requirements to service providers and the entity?

• A. A list of service providers
• B. The provider contact list
• C. Information about which PCI DSS requirements are managed by each service provider, and which are managed by the entity
• D. None

Answer: (C)

When using service providers, you must define who is responsible for each PCI DSS control. The information you need to maintain is a mapping that shows, for every PCI DSS requirement, whether the service provider or your organization is responsible for meeting it. This makes accountability clear, ensures all controls are covered, and supports accurate scoping and ongoing monitoring during assessments. A simple list of service providers or just a provider contact list doesn’t reveal who handles each control, so they don’t ensure coverage on their own. Keeping the per-requirement ownership mapping provides the necessary clarity for audits, contracts, and continuous compliance.