PCI-DSS Compliance Agreement

PCI-DSS Compliance Agreement

This PCI-DSS Compliance Agreement ("Agreement") is entered into as of by and between Client Name: with principal address: and Service Provider Name: with principal address: .

RECITALS

WHEREAS, Client engages Service Provider to perform services that involve the storage, processing or transmission of cardholder data in connection with Client's payment card transactions; and

WHEREAS, the parties desire to allocate responsibilities for achieving and maintaining compliance with the Payment Card Industry Data Security Standard ("PCI-DSS") and to define the procedures and remedies in the event of non-compliance or a security incident affecting cardholder data.

WHEREAS, Service Provider represents that it has implemented, and will maintain, administrative, physical and technical safeguards designed to meet PCI-DSS requirements for the systems and services within the scope described below.

NOW, THEREFORE, in consideration of the mutual promises contained herein, the parties agree as follows:

1. DEFINITIONS

For purposes of this Agreement, the following terms have the meanings set forth below:

"Cardholder Data" means full primary account numbers (PAN), cardholder name, expiration date, and service code, as well as any sensitive authentication data as defined by PCI-DSS.

"PCI-DSS" means the Payment Card Industry Data Security Standard and any successor standards, together with associated testing, reporting and attestation protocols required by card brands or acquiring banks.

"In-Scope Systems" means the systems, networks, and services that are used to store, process or transmit Cardholder Data within the Services provided by Service Provider and as further described in the Scope of Compliance.

2. SCOPE OF COMPLIANCE

The Scope of Compliance includes all In-Scope Systems and processes owned or controlled by Service Provider that directly or indirectly store, process or transmit Cardholder Data on behalf of Client. Parties shall document the scope as follows:

Any subsequent changes to the Scope of Compliance that materially alter the systems or volume of Cardholder Data shall be subject to the change management and notification requirements set forth in this Agreement.

3. SERVICE PROVIDER OBLIGATIONS

Service Provider covenants and warrants that it shall:

a) Implement and maintain administrative, physical and technical controls necessary to meet all applicable PCI-DSS requirements for In-Scope Systems and to produce an Attestation of Compliance or other evidentiary documentation upon Client's reasonable request.

b) Conduct internal or external PCI-DSS assessments at least and provide to Client within days following completion the corresponding Attestation of Compliance or Report on Compliance.

c) Remediate any confirmed deficiencies identified in a PCI-DSS assessment in accordance with the remediation timeline below and certify completion in writing.

4. CLIENT OBLIGATIONS

Client shall: (a) maintain its own environment and controls outside the defined Scope of Compliance; (b) notify Service Provider promptly of changes to Cardholder Data flows or payment channels affecting scope; and (c) cooperate with Service Provider in connection with assessments, audits and incident response activities, including providing timely access to personnel and records.

5. AUDIT RIGHTS AND ATTESTATION

Client has the right, upon reasonable prior notice, to require Service Provider to allow a qualified assessor or auditor to perform an assessment of In-Scope Systems. Such assessments shall be conducted no more frequently than unless a credible security incident or material change in scope occurs.

Service Provider shall provide: (i) a current Attestation of Compliance, (ii) applicable Report on Compliance or summary of assessment findings, and (iii) evidence of remediation for any critical findings within days of Client's request.

6. INCIDENT RESPONSE; NOTIFICATION

In the event of any actual or suspected compromise of Cardholder Data, Service Provider shall: (a) notify Client without undue delay and in no event later than hours after discovery; (b) preserve forensic data and cooperate in investigation; and (c) implement interim containment measures.

Costs associated with investigation and notification attributable to Service Provider's failure to comply with PCI-DSS shall be borne by Service Provider, subject to the indemnification provisions below.

7. CONFIDENTIALITY AND DATA HANDLING

Cardholder Data and related reports, Attestations of Compliance, assessment reports, logs and forensic materials are Confidential Information. Each party shall protect Confidential Information with at least the same degree of care it uses to protect its own confidential information, but in no event less than reasonable care.

Service Provider shall not use or disclose Cardholder Data except to perform obligations under this Agreement or as required by law, and shall implement data retention and disposal procedures consistent with PCI-DSS requirements and the parties' documented policies.

8. INDEMNIFICATION

Service Provider shall indemnify, defend and hold harmless Client, its officers, directors and affiliates from and against any third-party claims, liabilities, losses, damages, costs and expenses (including reasonable attorneys' fees) arising from Service Provider's breach of its PCI-DSS obligations under this Agreement or resulting from Service Provider's negligence, willful misconduct or failure to safeguard Cardholder Data.

9. LIMITATION OF LIABILITY

Except for liability arising from willful misconduct, gross negligence or Service Provider's breach of its indemnification obligations, neither party shall be liable to the other for incidental, consequential, punitive or special damages, including lost profits or business interruption, even if advised of the possibility of such damages.

10. TERM AND TERMINATION

This Agreement shall commence on the Effective Date and continue for an initial term of unless earlier terminated in accordance with this Section. Either party may terminate this Agreement for material breach by the other party if the breaching party fails to cure such breach within days after written notice.

11. NOTICES

All notices required or permitted under this Agreement shall be in writing and delivered to the parties at the addresses set forth below or at such other address as either party may designate by notice to the other.

12. AMENDMENTS; WAIVER; COUNTERPARTS

No amendment or waiver of any provision of this Agreement shall be effective unless in writing and signed by authorized representatives of both parties. Failure to exercise any right shall not constitute a waiver. This Agreement may be executed in counterparts, each of which shall be deemed an original, and all of which together shall constitute one instrument.

13. SEVERABILITY; ENTIRE AGREEMENT; GOVERNING LAW

If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall remain in full force and effect. This Agreement constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior agreements and understandings. This Agreement shall be governed by and construed in accordance with the laws of the state or jurisdiction identified below:

14. MISCELLANEOUS PROVISIONS

The parties acknowledge that compliance with PCI-DSS is an ongoing obligation requiring periodic assessments, timely remediation and cooperation. Neither party's compliance with this Agreement shall limit any regulatory or contractual obligations owed to card brands, acquiring banks or other third parties.

Sign Now