$7.$ If a merchant$$s cardholder data is shared with service providers, or could be impacted by service providers, what is the merchant required to maintain?$$

Copies of the service provides reports on compliance $($ROC$)$ for at least three years

Agreements with the service providers and program to monitor their compliance status

A list of all PANs that the service provider has access to

A program to visit serviced provider locations at least quarterly