Outsourcing and organisational control. You must ensure that all persons who have access to your Critical Systems, or who design, develop, operate, maintain, change, test and audit your Critical Systems comply with this Agreement and PCI DSS. You are responsible to ensure compliance even if such persons are not your employees. What to do in case of a Data Breach