The Payment Card Industry Security Standards Council (PCI SSC) this week announced new security standards for the design, development and maintenance of payment software.
The new PCI Secure Software Standard and the PCI Secure Lifecycle (SLC) Standard are part of a new Software Security Framework and their goal is to ensure that the development of payment software keeps up with modern practices.
The PCI Software Security Framework includes assessment and validation programs, which are expected to become available sometime this year.
The PCI Secure Software Standard summarizes the security requirements and assessment procedures for ensuring that payment software properly protects transactions and data. The standard focuses on secure default configurations, identification of critical assets, protection of sensitive data, access control and authentication, threat detection, and security guidance for vendors.
The standard is similar to the Payment Application Data Security Standard (PA-DSS) and the plan is to retire the PA-DSS over the next few years while a gradual transition is made towards the new standard.
PCI SSC hopes that this new standard will be used not only by organizations that sell, distribute or license payment software, but also by organizations that use and develop these types of tools internally.
The PCI Secure SLC Standard is meant to ensure that good security is maintained when changes are made to an application. Its key principles include vulnerability detection and mitigation, governance, security testing, threat detection, secure software updates, change management, and stakeholder communications.
This standard has been designed for software vendors that offer their products to the payment industry.
The new standards have been developed based on feedback from hundreds of software vendors, assessors and payment security experts, the PCI SSC said.
“Software development practices have evolved over time, and the new standards address these changes with an alternative approach for assessing software security,” said PCI SSC Chief Technology Officer Troy Leach. “The PCI Software Security Framework introduces objective-focused security practices that can support both existing ways to demonstrate good application security and a variety of newer payment platforms and development practices.”
Related: What You Need to Know About PCI DSS Compliance this Holiday Season
Related: Wi-Fi Alliance Launches WPA3 Security Standard
Related: UK Publishes Minimum Cyber Security Standard for Government Departments