eTrepid PCI-DSS v4.0 Shared Responsibility & MSSP Scoping Guide
Governing Standard: PCI-DSS v4.0 (Payment Card Industry Data Security Standard)
1. Service Provider Role Demarcation
eTrepid Inc. operates as a specialized Managed Security Service Provider (MSSP). eTrepid does not directly store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD) on behalf of clients.
However, eTrepid manages network infrastructure, firewall perimeters, endpoint security agents, and logging services that impact the security of customer Cardholder Data Environments (CDE). This document provides guidance for customer Qualified Security Assessors (QSAs) scoping eTrepid's role under PCI-DSS v4.0.
2. PCI-DSS v4.0 12-Requirement Responsibility Split
| PCI-DSS v4.0 Domain | eTrepid MSSP Scope | Customer Responsibility |
|---|---|---|
| Req 1: Network Security Controls | Configures and monitors next-gen firewalls, network segmentation rules, and perimeter access control lists (ACLs). | Formally approves firewall change tickets and maintains CDE boundary definitions. |
| Req 2: Secure Configurations | Deploys hardened system baselines, disables unnecessary services, and enforces secure cipher suites. | Ensures third-party POS applications adhere to vendor hardening guidance. |
| Req 5: Malicious Software Defense | Deploys and manages endpoint detection and response (EDR) with real-time behavioral protection. | Refrains from altering or disabling antivirus agents on CDE endpoints. |
| Req 6: Secure Systems & Software | Applies security patches across managed operating systems and infrastructure within mandated windows. | Manages custom in-house application patching and secure development lifecycles. |
| Req 8: Identification & Authentication | Enforces multi-factor authentication (MFA) for all administrative and remote access to systems. | Manages end-user identity lifecycles, permissions, and credential terminations. |
| Req 10: Log Monitoring & Review | Ingests, centralizes, and monitors system logs via 24/7 SOC correlation with audit trail retention. | Authorizes incident response escalation protocols and participates in audit reviews. |
3. Attestation of Compliance (AoC) Information
eTrepid provides annual Service Provider Attestations of Compliance (AoC) covering managed security controls upon request to active commercial clients under NDA.
🔒 Restricted Technical Companion Available
This document is an executive summary of a restricted operational standard. Qualified defense contractors and certified C3PAO assessment teams subject to CMMC Level 2 or NIST SP 800-171 audits may request unredacted inspection under our mutual non-disclosure agreement.