Listen Audio version
PCI SSC introduced a fairly new framework which is the Payment Card Industry Software Security Framework that is effective from October 2022. PCI SSF is a combination of different standards and programs designed and developed to secure payment software.
It is a framework introduced to replace the Payment Application Data Security Standard (PA-DSS) with modern requirements that supports a variety of payment software types, technologies, and development methodologies. The framework provides the flexibility for software developers to incorporate payment application security with current industry best Software Development Lifecycle Practices and frequent update cycles.
The framework consists of two standards namely the Secure Software Lifecycle (SLC) Standard and Secure Software Standard. The application of either standard depends on the eligibility criteria. Given below are details of both the standards explained for a better understanding of the framework.
Also Read:- Transition From PA DSS TO PCI SSF
What is a Secure Software Standard?
The PCI Secure Software Standard (PCI SSS) is a set of requirements outlined in the PCI SSF Framework that required Payment Software Vendors to validate in order to qualify as a Validated Payment Software or Listed Payment Software by the PCI Security Standard Council.
Validating the Payment Software ensures a secure development of the application as per the industry best standards and practices. The validation assures that the Payment Software is securely developed to protect the integrity of the software and the confidentiality of sensitive data it stores, processes, and transmits.
Payment software developed by the vendor that is meant to support or facilitate payment transactions in terms of processing, transmit or storing payment data or software that are commercially available for sale to multiple organizations qualify for validation and listing. All the validated payment software are identified and listed on the PCI SSC’s website in the list of Validated Payment Software.
What is the Secure Software Lifecycle standard?
A PCI Secure Software Lifecycle (SLC) is a standard developed and focused on ensuring that the software vendor’s software development process, methodologies, and practices are secure. Evaluating the software lifecycle management practices against the Secure SLC Standard demonstrates the organization has mature software development practices and can develop secure payment software.
This further assures that the payment software is secure for supporting any kind of payment transactions, while it reduces the risk exposure or vulnerabilities by building a strong defense against attacks. Overall the validation against the PCI SSL demonstrates the level of security of the vendor’s SLC processes, technology, and design, development, and maintenance of the payment software throughout the entire software lifecycle.
Difference between Secure Software Standard (SSS) and Secure Software Lifecycle (SLC)
Secure Software Standard (SSS) and Secure Software Lifecycle (SLC) are two different programs under the Payment Software Security Framework (PCI SSF). Both the programs focus on different aspects of software security validation. While SLC validates the security controls and practices of the software design and development, the SSS reviews the overall effectiveness of the security of the software.
So, organizations may be validated for Secure Software Lifecycle for their software development process and additionally validated for Secure Software Standard for payment software’s developed. PCI SSS applies to only those software vendors who develop Payment Software that is sold, distributed, or licensed to third parties.
This may include Payment Software intended to be used by customers or installed in their systems or, regardless of how the software is delivered. Whereas PCI Secure SLC applies to any software vendors who wish to validate and ensure the effectiveness of their Payment Software applications security. However, it is important to note that Software vendors do not necessarily need validation against Secure SLC if they are validated for SSS. However, Secure SLC validation can ease the process of maintaining the validation of the payment software when making changes to it.
To learn more about PCI SSF and its two programs PCI SSS and PCI SLC you can read our blogs on the link given below. Also if you are looking to get validated against any of the two PCI SSF programs, you can always approach us at VISTA InfoSec. We are a qualified PCI SSF Assessor having the industry knowledge and expertise to guide you through the process of compliance and validation. For more details about us or our PCI SSF services, you can even drop us a mail at info[@]vistainfosec.com
