Payment software security and the security of a merchant’s operating environment are related responsibilities. PA-DSS and PCI DSS historically addressed different parts of that picture, but they are no longer two active validation routes.
Program update: PCI SSC retired the Payment Application Data Security Standard (PA-DSS) on October 28, 2022. Its successor is the PCI Software Security Framework (SSF), comprising the Secure Software Standard and the Secure Software Lifecycle Standard. New software validation should be considered under the applicable current SSF program, rather than the retired PA-DSS program.
What PA-DSS covered
PA-DSS was a validation program for eligible payment applications supplied to third parties. It assessed application security requirements and included guidance for secure installation. References to PA-DSS in older application documentation describe that historical program; they should not be read as instructions to obtain a new PA-DSS validation today.
What applies to payment software now?
The Secure Software Standard addresses the security of eligible payment software. The Secure Software Lifecycle Standard addresses the vendor’s software lifecycle practices. These are separate standards within SSF, with their own applicability and assessment requirements. Software vendors should review current program eligibility and validation options with a qualified assessor.
What PCI DSS covers
PCI DSS addresses the protection of payment account data within an entity’s environment. Its scope can include merchants, service providers, and other entities involved in storing, processing, or transmitting cardholder data, or that can affect the security of the cardholder data environment. Confirm validation and reporting obligations with the acquirer, payment brand, or other organization managing the compliance program.
Using validated payment software does not, by itself, establish the merchant’s PCI DSS compliance. Installation, configuration, access, networks, operations, and the surrounding systems still need to be evaluated within the applicable PCI DSS scope.
Existing PA-DSS deployments
All PA-DSS application listings have expired. PCI SSC distinguishes applications acceptable only for pre-existing deployments from current software validation. An expired PA-DSS listing is not a new validation or automatic authorization for a new deployment. Payment brands and acquirers determine their own acceptance and continued-use requirements.
Organizations with an existing application should confirm its support status, security updates, integration risks, and acceptance with their software vendor and compliance-accepting entity. Plan migration where required rather than assuming the historical listing remains sufficient.
Practical next steps
- Software vendors: Identify applicable SSF standards and current validation requirements. Maintain secure development, vulnerability management, and update processes.
- Merchants and service providers: Define the PCI DSS scope and verify how the software is securely deployed and operated.
- Existing customers: Check the status and support of legacy applications and obtain the relevant acquirer or payment-brand guidance.
- All organizations: Protect account data, restrict access, monitor systems, test security, and maintain an incident response process appropriate to your environment.
See PCI SSC’s PA-DSS retirement guidance and its Secure Software and Secure Software Lifecycle standards for current program information.
