When dealing with compliance with the Payment Card Industry-Data Security Standard (PCI- DSS), an organization that shares card holder information with a service provider MUST do which of the followin

PCI-DSS does not require the sharing organization to personally perform a PCI-DSS assessment on the service provider; rather, the organization must validate the provider's compliance status, which can be done via the provider's own attestation or listing on Visa/Mastercard's compliance registries.

PCI-DSS Requirement 12.8 mandates that entities maintain and monitor their service providers' PCI-DSS compliance status on a regular basis. This includes maintaining a list of service providers, having written agreements acknowledging their responsibility for cardholder data security, and monitoring their compliance status at least annually - not necessarily conducting the assessment themselves, but validating that compliance is maintained.

PCI-DSS does not require that a service provider's security policies be in full alignment with the hiring organization's policies; the standard focuses on the service provider meeting PCI-DSS requirements independently, not mirroring another entity's internal policies.

While Disaster Recovery Plan testing is a component of PCI-DSS compliance, PCI-DSS does not specifically require the hiring organization to ensure the service provider updates and tests its DRP on a yearly basis as the primary obligation when sharing cardholder data.