FAQ #1427 Diff

Original equipment manufacturers (OEMs) and equipment resellers may provision equipment initially for the CDE,cardholder data environment (CDE), but once the equipment has been provisioned, they may no longer be involved in the day-to-day operation of the product.  If the OEM simply provides a product and is not involved in its operation or maintenance, they wouldare not be expected to implement agreementsconsidered third-party service providers (TPSPs) for the purposes of meeting Requirements 12.8 and 12.9.

However, if the OEM or reseller also provides additional ongoing services—such as supporting the ongoing operation of the equipment or software—or has access to their customer’scustomer's CDE, then they would be TPSPs for their customers and the agreements described in 12.8 and 12.9 would be applicable for the TPSP services being offered.

Refer to the PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms  forin Appendix G for the full definition of Service Providers.