Service Provider scope (ROC)
Hi everyone, I did some searching but couldn't find an answer, so figured I'd try submitting a post. I work in Engineering for a Managed Service Provider that provides fully managed network services such as managed firewall, IDS, and even bundles SAQ portal services (resold from 3rd party) to retail, restaurant, and convenience store market segments. We also resell transit from regional carriers/providers, but that part of our business has slowly been winding down for several years now. As part of our PCI recertification efforts, I noticed our ROC scope explicitly includes these network services, although it explicitly excludes any services we provide on our customers behalf for on-premise devices such as security configuration and management. My question is related to one of positioning - our internal positioning is that as long as our organization maintains a ROC and our status of being a Managed Services Provider is checked, the actual scope of our certification is a non-issue. This feels a bit off since most of our (non-network) Managed Services are represented as PCI compliant and help an end-customer achieve or maintain their own compliance. What I'm asking is two-fold: 1) are there any guidelines around PCI certified Service Provider scope with regard to what they can/can't claim are compliant services, and 2) are there ethics standards/guidelines PCI certified service providers must adhere to as part of being certified? I can provide some more technical details if necessary. Thanks in advance!
Posted Aug 17, 2017, 7:43 PM UTC