The argument
The Vendor Says They Are PCI Compliant. Ask These Seven Questions.
A merchant should not attempt to re-assess every provider, but it should perform enough due diligence to understand what service is covered, by what current evidence, for which activities and locations, with which exclusions and customer responsibilities, and how changes are communicated. Official PCI SSC validation forms matter; a marketing certificate or trust-page badge is not a substitute. The resulting record supports reliance on a provider without turning provider status into the merchant's own compliance conclusion.
The field pattern
A member's ecommerce vendor sends a one-page PCI certificate. The document does not identify the exact service, assessed locations, covered requirements, customer responsibilities, report period, or current status. Sales says this is what every customer receives. The member files it and marks the provider question complete.
Why it matters
Ask seven questions: What exact service do we use? What official current evidence supports it? Is that service in the assessed scope? Which locations and activities are covered? What is excluded or limited? What remains customer or shared responsibility? What change or incident notification will we receive?
Preserve the provider's AOC or other appropriate evidence, service and scope description, responsibility information, dates, limitations, correspondence, and the merchant's own decision record.
Do not convert missing or contradictory documentation into either automatic rejection or blind acceptance. Open a bounded question, identify the affected merchant claim, request correction, and escalate through accountable channels.
Review provider evidence and responsibility at the required cadence supplied by the applicable program and whenever the service, feature, configuration, incident state, or evidence changes.
Questions that expose the Wack
- Does the evidence name the exact service the merchant consumes?
- Is the evidence an official current validation form rather than a certificate alone?
- Which merchant duties remain and who owns them?
- What event reopens the provider reliance decision?