Al, I am considering sending the following statement (blue) to Coalfire. Thoughts? I believe Coalfire is attempting to expand scope in the form of requiring Multiple, on-demand assessments. A definite increase in scope as instead of sampling a few LPA Office, they would then perform Multiple, on-demand assessments on all LPA sites. As per PCI_DSS_v3-2 Third-Party Service Provider Definition: Use of Third-Party Service Providers / Outsourcing A service provider or merchant may use a third-party service provider to store, process, or transmit cardholder data on their behalf, or to manage components such as routers, firewalls, databases, physical security, and/or servers. If so, there may be an impact on the security of the cardholder data environment. As per PCI_DSS_v3-2 there are two options for third-party service providers to validate compliance: 1) Annual assessment: Service providers can undergo an annual PCI DSS assessment(s) on their own and provide evidence to their customers to demonstrate their compliance; or 2) Multiple, on-demand assessments: If they do not undergo their own annual PCI DSS assessments, service providers must undergo assessments upon request of their customers and/or participate in each of their customer’s PCI DSS reviews, with the results of each review provided to the respective customer(s) NCDOT Response Statement: …show more content…
Using your logic, especially with respect to “Cleaning Crew” companies within a non-active office (not Data Center) also being a PCI Service Provider is unheard of