PCI Secure Software Standard

Overview

The PCI Secure Software Standard validates that payment software has been designed, developed, and maintained in a manner that protects payment transactions and data. It replaces the legacy PA-DSS (Payment Application Data Security Standard) and focuses on software security objectives rather than prescriptive controls. CodeMiners' payment applications are validated against this standard to ensure they meet PCI requirements for secure payment data handling.

Governing Body

PCI Security Standards Council (PCI SSC)

Scope of Certification

Covers the security of payment software throughout its lifecycle. Evaluates authentication, access control, sensitive data protection, logging, cryptography, and vulnerability management within the software itself.

Audit and Assessment Process

Assessment is conducted by a PCI-qualified Secure Software Assessor. The assessor evaluates the software against core and module-specific security objectives. Validation is listed on the PCI SSC website. Revalidation is required for major version changes.

Key Requirements

1. Secure authentication and access control mechanisms
2. Protection of sensitive payment data at rest and in transit
3. Secure cryptographic implementation
4. Activity logging and audit trail capabilities
5. Vulnerability identification and patching procedures
6. Secure default configuration and deployment guidance

Compliance Entitlements

• PCI-validated payment software security
• Successor to the PA-DSS standard
• Objective-based security validation rather than prescriptive controls
• Listed on the PCI SSC validated payment software directory

Client Benefits

• Ensures payment applications meet PCI software security requirements
• PCI SSC listing provides independent verification for client compliance teams
• Reduces client PCI assessment scope when using validated payment software

Related Certifications