Meeting the Third-Party Risk Requirements of PCI DSS in 2024 | UpGuard

This article explains PCI DSS v4.0 with a focus on third-party risk management (TPRM), detailing responsibilities for entities and service providers, key sub-requirements under 12.8/12.9 (vendor inventory, due diligence, written agreements, compliance monitoring, and responsibility mapping), and the four compliance levels tied to transaction volume and breach history. It also describes how UpGuard’s platform can support PCI-related TPRM activities through vendor inventories, assessments, documentation, and continuous monitoring.