5-Appendix B - PCI Compliance.pdf

This document is an Appendix B detailing PCI (Payment Card Industry) Compliance requirements for a contract, specifically with UTA (Utah Transit Authority). The appendix outlines comprehensive guidelines for contractors handling credit card services, mandating compliance with PCI DSS v4.0 (or current version) for all services involving cardholder data storage, processing, and transmission.

The document establishes six key compliance areas: (a) compliance requirements, (b) contractor responsibilities, (c) annual validation procedures, (d) breach notification protocols, (e) UTA's audit rights, and (f) subcontractor flow-down requirements. Critical obligations include maintaining PCI DSS compliance across all people, processes, and technologies; providing annual documentation like Attestation of Compliance and Self-Assessment Questionnaires; notifying UTA within 24 hours of any suspected data breach; and ensuring that any third-party subcontractors also comply with PCI DSS standards. UTA reserves the right to audit the contractor's compliance status, request documentation, and suspend services for non-compliance.