PCI DSSRequirement 12.8.4mandates that an entitymonitor the compliance status of third-party service providers (TPSPs) at least annually, especially when those TPSPs store, process, or transmit account data on the entity's behalf.
* Option A:Incorrect. Entities are not responsible for conducting ASV scans on TPSPs.
* Option B:Incorrect. There is no quarterly risk assessment requirement for TPSPs.
* Option C:Incorrect. Incident response testing for TPSPs is not a direct responsibility of the entity.
* Option D:Correct. Annual monitoring of TPSP compliance is explicitly required.