Has an incident response plan been created to be implemented in the event of system breach?

Is a list of service providers maintained, including a description of the service(s) provided?

Is there an established process for engaging service providers, including proper due diligence prior to engagement?

Is information maintained about which PCI DSS requirements are managed by each service provider, and which are managed by the entity?