How to meet the additional requirement for Service Provider only by PCI DSS v4.0 provision 12.4.2?