TMPL-014: Plantilla de Vendor Compliance Tracker

Campo	Valor
ID	TMPL-014
Versión	1.0
Fecha de emisión	2026-06-16
Propietario	CISO + Procurement
PCI DSS	Req 12.8.1, 12.8.2, 12.8.4, 12.8.5
Retención	7 años post-termination del contrato

1. Propósito

Plantilla normalizada para mantener el tracking continuo del cumplimiento de cada TPSP (Third-Party Service Provider) según PCI DSS Req 12.8.

2. Estructura del Tracker

Para cada vendor en alcance, se mantiene una entrada con los siguientes campos:

2.1 Identificación del Vendor

Vendor ID:                  VND-YYYY-NNN
Vendor legal name:          [Razón social]
Vendor commercial name:     [Nombre comercial]
Vendor type:                [SaaS / IaaS / PaaS / On-prem / Hybrid / Open-source]
Country of incorporation:   [País]
Primary PoC name:           [Nombre]
Primary PoC email:          [email]
Security PoC name:          [Nombre]
Security PoC email:         [email]
Account manager:            [Nombre]

2.2 Servicios prestados a Fintrixs

Service category:           [Cloud infra / SIEM / Backup / Monitoring / Code / Pentest / etc.]
Service description:        [Free text describing what they do for us]
Data accessed:              [None / Metadata / Logs / Credentials / CHD / PII]
Systems accessed:           [Out-of-CDE / VPC peer / Direct CDE / Via API only]
Network access path:        [Internet / VPN / Bastion / IP allowlist]

2.3 Contractual

MSA effective date:         [YYYY-MM-DD]
MSA expiration date:        [YYYY-MM-DD]
MSA renewal type:           [Auto-renew / Manual / Term-end]
DPA in place:               [Yes / No / N/A]
DPA last updated:           [YYYY-MM-DD]
SCCs (data transfer):       [Module 2 SCC / N/A]
SLA tier:                   [Bronze / Silver / Gold / Platinum]
SLA uptime guarantee:       [99.9% / 99.95% / 99.99%]
Liability cap:              [USD amount]
Termination notice:         [Days]
Audit rights clause:        [Yes / No]

2.4 Estado de cumplimiento

PCI DSS attestation:        [Level 1 SP AOC / Level 2 / Merchant / N/A]
PCI DSS last attestation:   [YYYY-MM-DD]
PCI DSS valid until:        [YYYY-MM-DD]
SOC 2 Type II:              [Yes / No]
SOC 2 last report:          [YYYY-MM-DD]
ISO 27001:                  [Yes / No]
ISO 27001 valid until:      [YYYY-MM-DD]
ISO 27017 (cloud):          [Yes / No]
ISO 27018 (PII):            [Yes / No]
HIPAA BAA available:        [Yes / No]
NIST 800-53:                [Yes / No]
FedRAMP:                    [Yes / No]
Trust Center URL:           [URL]
Last vendor audit date:     [YYYY-MM-DD]
Next vendor audit date:     [YYYY-MM-DD]

2.5 Compliance acknowledgement

Vendor agreed to comply
with PCI DSS for services
provided:                   [Yes / No]
Reference clause in MSA:    [Section X.Y]
Last ack date:              [YYYY-MM-DD]
Re-attestation due:         [YYYY-MM-DD]

2.6 Shared responsibility matrix

PCI Req | Responsibility | Notes
─────────────────────────────────────────────
1.x     | [Vendor / Fintrixs / Shared] | ...
2.x     | [Vendor / Fintrixs / Shared] | ...
3.x     | [Vendor / Fintrixs / Shared] | ...
...
12.x    | [Vendor / Fintrixs / Shared] | ...

2.7 Risk + monitoring

Vendor risk score:          [Critical / High / Medium / Low]
Vendor risk justification:  [Free text]
Annual review date:         [YYYY-MM-DD]
Last incident with vendor:  [YYYY-MM-DD or none]
Next renewal date:          [YYYY-MM-DD]
Decommission planned:       [Yes / No / Date]

3. Workflow operacional

Day -90 (pre-onboarding):
  ├── Procurement initiates vendor evaluation
  ├── Security questionnaire (CAIQ + SIG)
  ├── Background check (POL-008 §3)
  ├── Review attestations (PCI / SOC 2 / ISO)
  └── Risk score assigned

Day -60:
  ├── MSA + DPA drafted
  ├── PCI compliance clauses negotiated
  ├── Shared responsibility matrix documented
  └── Legal review

Day -30:
  ├── MSA signed
  ├── TMPL-014 record created
  └── Onboarding scheduled

Day 0 (live):
  ├── Access provisioned with least privilege
  ├── Monitoring enabled (Wazuh + Rapid7)
  └── First quarterly check

Day 365 (annual review):
  ├── Re-validate attestations vigentes
  ├── Confirm services unchanged
  ├── Update TMPL-014 record
  ├── Vendor re-attestation if MSA renewed
  └── New risk score

4. Storage schema

sql

CREATE TABLE pci_compliance.vendor_tracker (
  vendor_id              text PRIMARY KEY,           -- VND-YYYY-NNN
  legal_name             text NOT NULL,
  commercial_name        text,
  vendor_type            text NOT NULL,
  country                text NOT NULL,
  primary_poc_email      text NOT NULL,
  security_poc_email     text,

  -- Services
  service_category       text NOT NULL,
  service_description    text NOT NULL,
  data_accessed          text NOT NULL,
  systems_accessed       text NOT NULL,

  -- Contractual
  msa_effective_date     date NOT NULL,
  msa_expiration_date    date,
  dpa_in_place           boolean NOT NULL DEFAULT false,
  liability_cap_usd      numeric(15,2),
  audit_rights_clause    boolean NOT NULL DEFAULT false,

  -- Compliance
  pci_attestation_level  text,                       -- Level 1 SP / etc
  pci_valid_until        date,
  soc2_type2             boolean NOT NULL DEFAULT false,
  soc2_last_report       date,
  iso27001               boolean NOT NULL DEFAULT false,
  iso27001_valid_until   date,
  trust_center_url       text,
  last_vendor_audit      date,
  next_vendor_audit      date NOT NULL,              -- forces tracking

  -- Risk
  risk_score             text NOT NULL CHECK (risk_score IN ('Critical','High','Medium','Low')),
  risk_justification     text NOT NULL,

  -- Acknowledgement
  pci_compliance_ack     boolean NOT NULL DEFAULT false,
  pci_ack_clause_ref     text,
  last_ack_date          date,
  re_attestation_due     date,

  -- Lifecycle
  status                 text NOT NULL DEFAULT 'active'
                           CHECK (status IN ('evaluating','active','suspended','terminated')),
  created_at             timestamptz NOT NULL DEFAULT now(),
  updated_at             timestamptz NOT NULL DEFAULT now()
);

REVOKE UPDATE, DELETE ON pci_compliance.vendor_tracker FROM PUBLIC;

5. Triggers anuales

Trigger	Action
`next_vendor_audit <= NOW() + 30 days`	Email reminder to CISO
`pci_valid_until <= NOW() + 60 days`	Verify renewal in progress
`soc2_last_report > NOW() - 14 months`	Request new SOC 2 report
`msa_expiration_date <= NOW() + 90 days`	Initiate renewal discussion

6. Vínculos

POL-008 Third-Party Management
Q91 — Service Provider Agreements
Q60 — Physical Visitor Logs / DO AOC
PCI DSS v4.0 Req 12.8.1 + 12.8.2 + 12.8.4 + 12.8.5

TMPL-014: Plantilla de Vendor Compliance Tracker ​

1. Propósito ​

2. Estructura del Tracker ​

2.1 Identificación del Vendor ​

2.2 Servicios prestados a Fintrixs ​

2.3 Contractual ​

2.4 Estado de cumplimiento ​

2.5 Compliance acknowledgement ​

2.6 Shared responsibility matrix ​

2.7 Risk + monitoring ​

3. Workflow operacional ​

4. Storage schema ​

5. Triggers anuales ​

6. Vínculos ​