PCI DSS template · PCI DSS v4.0
Vendor & Third-Party Management Policy
Management of third-party service providers with access to or impact on cardholder data and the CDE. Written for your company, citing the controls below.
- Sections
- 6
- Controls cited
- 6
- Formats
- PDF, Word
- Shelf
- 12 PCI DSSdocuments in all
No card needed to start.
- Cites
- Req. 12.8, SOC 2 CC9.2, ISO A.5.19 and 3 more
- Formats
- PDF and Word
Sections
Each written around your company: your tools, your roles, your review dates.
- Purpose and Scope
- TPSP Inventory
- Due Diligence Requirements
- Contractual Security Requirements
- Ongoing Monitoring
- TPSP Termination
Controls it cites
The PCI DSS controls first, then the matching controls in other frameworks.
- Req. 12.8Third-Party Service ProvidersPCI DSS
- SOC 2 CC9.2Risk Mitigation: Vendor & Business PartnerSOC 2
- ISO A.5.19Information Security in Supplier RelationshipsISO 27001
- ISO A.5.23Information Security for Cloud ServicesISO 27001
- HIPAA §164.308(b)(1)Business Associate ContractsHIPAA
- GDPR Art. 28Processor ObligationsGDPR
Recent changes
Updates from official sources that name this policy. All policy updates
7 Oct 2026 · PCI Security Standards Council
PCI SSC publishes Key Management and Operations (KMO) Standard v1.0Update the Vendor & Third-Party Management Policy to address the use of KMO-assessed services and cloud-based HSM providers.
10 Jun 2026 · PCI Security Standards Council
PCI SSC publishes guidance on compensating controls and customized approachUpdate the Vendor & Third-Party Management Policy to ensure assessor independence is maintained when third parties are involved in control design or implementation.
- PCI DSS7 sections
Encryption Policy
CitesReq. 3 Req. 4 SOC 2 CC6.7 +4 +5PDF · WordCites Req. 3, Protect Stored Account Data (PCI DSS); Req. 4, Protect Data in Transit (PCI DSS); SOC 2 CC6.7, Logical & Physical Access: Transmission Security (SOC 2), and 4 more. - PCI DSS7 sections
Password & Authentication Policy
CitesReq. 8 SOC 2 CC6.1 SOC 2 CC6.2 +3 +4PDF · WordCites Req. 8, Identify Users & Authenticate (PCI DSS); SOC 2 CC6.1, Logical & Physical Access: Security Software (SOC 2); SOC 2 CC6.2, Logical & Physical Access: Credentials (SOC 2), and 3 more. - PCI DSS7 sections
Change Management Policy
CitesReq. 6 SOC 2 CC8.1 ISO A.8.32 +2 +3PDF · WordCites Req. 6, Secure Development (PCI DSS); SOC 2 CC8.1, Change Management (SOC 2); ISO A.8.32, Change Management (ISO 27001), and 2 more. - PCI DSS7 sections
Firewall & Network Security Policy
CitesReq. 1 Req. 2 SOC 2 CC6.6 +4 +5PDF · WordCites Req. 1, Network Security Controls (PCI DSS); Req. 2, Secure Configurations (PCI DSS); SOC 2 CC6.6, Logical & Physical Access: External Threats (SOC 2), and 4 more. - PCI DSS7 sections
Cardholder Data Protection Policy
CitesReq. 3 Req. 4 SOC 2 CC6.7 +4 +5PDF · WordCites Req. 3, Protect Stored Account Data (PCI DSS); Req. 4, Protect Data in Transit (PCI DSS); SOC 2 CC6.7, Logical & Physical Access: Transmission Security (SOC 2), and 4 more. - PCI DSS7 sections
Vulnerability Management Policy
CitesReq. 5 Req. 6 Req. 11 +4 +5PDF · WordCites Req. 5, Anti-Malware (PCI DSS); Req. 6, Secure Development (PCI DSS); Req. 11, Test Security (PCI DSS), and 4 more.
PCI DSS on its own
- Documents
- 12
- Plan
- Growth
- Price
- $199 a month or $1,990 a year
Growth also covers HIPAA, so PCI DSS + HIPAA stays at $199 a month. Two frameworks besides HIPAA need Scale.
Your first policy is free. No card needed to start.