This document gives requirements and guidance on security controls and implementation for third-party payment service providers (TPPSPs). This document deals with the overall security controls of TPPSPs from developing and testing to installing, operating and auditing the system. These security controls consist of:
security governance controls;
cross-functional controls;
function-specific controls.
BSI recommends this version of standard for organisations operating in or with the UK. The ISO edition is available here if required.