MA-PCI-SSC
Today, the PCI Security Standards Council (PCI SSC) published new requirements for the secure design and development of modern payment software. The PCI Secure Software Standard and the PCI Secure Lifecycle (Secure SLC) Standard are part of a new PCI Software Security Framework , which includes a validation program for software vendors and their software products and a qualification program for assessors. The programs will be launched later in 2019.
“Innovation in payments is moving at an incredible pace. Each advancement provides the industry the opportunity to develop applications more quickly and efficiently than before and to design software for new platforms for payment acceptance,” said PCI SSC Chief Technology Officer Troy Leach. “The new PCI Secure Software Standard and PCI Secure SLC Standard support this evolution in payment software practices by providing a dynamic way for developers to demonstrate their software protects payment data for the next generation of applications.”
PCI Software Security Standards expand beyond the scope of the Payment Application Data Security Standard (PA-DSS) for traditional payment software to address overall software security resiliency for modern payment software. Specifically:
- The PCI Secure Software Standard outlines security requirements and assessment procedures to help ensure payment software adequately protects the integrity and confidentiality of payment transactions and data.
- The PCI Secure SLC Standard outlines security requirements and assessment procedures for software vendors to validate how they properly manage the security of payment software throughout the entire software lifecycle.
These standards will replace the PA-DSS and listing when it is retired in 2022. In the meantime, there will be a gradual transition period for organizations with investments in PA-DSS. For more information on the new standards and the PA-DSS transition period, read PCI Perspectives blog post, Just Published: New PCI Software Security Standards .
The PCI Software Security Standards were developed with the input of a dedicated task force made up of payment card industry participants. PCI SSC Participating Organizations and assessors also reviewed and provided feedback on the standards via multiple request for comments (RFC) periods throughout the development process.
Steve Lipner, Executive Director of the Software Assurance Forum for Excellence in Code (SAFECode), participated in the PCI Software Security Task Force and said, “I was delighted to review the final version of the PCI Secure Software Lifecycle Standard. The document clearly reflects an adaptation of software security best practices to the needs of the payment card industry and its certification process and is well aligned with SAFECode’s principles and the concepts in SAFECode’s Fundamental Practices for Secure Software Development. I was particularly pleased to see the emphasis on integrating security into the software development process rather than attempting to assure security by after-the-fact testing.”
The PCI Secure Software Standard, PCI Secure SLC Standard, a supporting FAQ document, and a Glossary of Terms, Abbreviations, and Acronyms are available for download from the Document Library on the PCI SSC website.
About the PCI Security Standards Council
The PCI
Security Standards Council
(PCI SSC) leads a global, cross-industry
effort to increase payment security by providing industry-driven,
flexible and effective data security standards and programs that help
businesses detect, mitigate and prevent cyberattacks and breaches.
Connect with the PCI SSC on LinkedIn
.
Join the conversation on Twitter @PCISSC
.
Subscribe to the PCI
Perspectives Blog
.
View source version on businesswire.com: https://www.businesswire.com/news/home/20190116005557/en/
Contact:
Mark Meissner PCI Security Standards Council +1-202-744-8557 press@pcisecuritystandards.org Twitter @PCISSC
About Business Wire
Subscribe to releases from Business Wire
Subscribe to all the latest releases from Business Wire by registering your e-mail address below. You can unsubscribe at any time.
Latest releases from Business Wire
CA-NETAPP18.3.2024 23:01:28 CET | Press release
NetApp Empowers Customers to Securely “Talk to Their Data” in Collaboration with NVIDIA
KPMG18.3.2024 18:39:35 CET | Press release
KPMG’s "Digital Gateway for Tax" Platform Raises Global Standards in Tax Functionality with Generative AI
DANCHURCHAID18.3.2024 18:07:34 CET | Press release
Media invitation: World leaders must make headway for adaptation - there are no alternatives
CA-VERIMATRIX18.3.2024 17:46:33 CET | Press release
Verimatrix Releases Counterspy as a New Anti-Piracy Solution with First-Ever Defensive Capabilities
VERACODE18.3.2024 15:43:32 CET | Press release
Centrico Spa (Gruppo Banca Sella) and Veracode Enter Deal to Help Secure the Application Development Life Cycle
In our pressroom you can read all our latest releases, find our press contacts, images, documents and other relevant information about us.
Visit our pressroom