PCI DSS and PA-DSS addressed different parts of payment security. PCI DSS remains the standard for protecting payment account data within an entity’s environment. PA-DSS was a payment-application validation program and is now retired.
PA-DSS is a historical program
PCI SSC retired PA-DSS on October 28, 2022. It was superseded by the PCI Software Security Framework (SSF), which includes the Secure Software Standard and the Secure Software Lifecycle Standard. A software vendor developing a new POS application should review the applicable current SSF validation route, rather than seek a new PA-DSS validation.
Historically, PA-DSS evaluated eligible third-party payment applications and their secure installation guidance. It did not replace a merchant’s responsibility to operate its environment securely or validate applicable PCI DSS requirements.
The current software standards
- Secure Software Standard: Addresses the security of eligible payment software.
- Secure Software Lifecycle Standard: Addresses the vendor’s software lifecycle practices.
The standards have separate scopes and assessment requirements. Vendors should confirm their software’s eligibility, the applicable program, and the assessment route with a qualified assessor. A software validation and an entity’s PCI DSS assessment are different activities.
What PCI DSS requires of an organization
PCI DSS applies to environments that store, process, or transmit cardholder data, and can also apply to systems or services that affect the security of the cardholder data environment. Its requirements cover areas including network security, account-data protection, vulnerability management, access control, monitoring and testing, and information security policies.
The relevant acquirer, payment brand, or other compliance-accepting entity determines validation and reporting obligations. A QSA assessment or an eligible self-assessment may be appropriate depending on the compliance program and the environment; not every business follows the same reporting route.
What about applications already deployed under PA-DSS?
All PA-DSS application listings have expired. PCI SSC identifies historical applications as acceptable only for pre-existing deployments. Continued use and any migration requirements must be confirmed with the relevant payment brand or acquirer. An expired PA-DSS listing is not an active validation and should not be treated as approval for a new deployment.
Check the application’s support and update status with its vendor, review the deployment risks, and confirm acceptance requirements before making purchasing or migration decisions.
Choose the right next step
- Developing payment software: Review current SSF eligibility and validation requirements.
- Accepting or processing payments: Confirm the PCI DSS scope, controls, and reporting obligations for your environment.
- Using legacy software: Verify support, acceptance, and migration expectations with your vendor and compliance-accepting entity.
Consult PCI SSC’s PA-DSS retirement guidance and the current Secure Software and Secure Software Lifecycle standards.
