Bespoke and Custom Software
PCIComplianceHubLast updated
The v4.x term for software written for one organization rather than sold off the shelf. Bespoke software is built for the entity by a third party, to specifications the entity sets; custom software is built by the entity for its own use. Both fall under Requirement 6, covering secure development practices, code review, vulnerability management and change control. The distinction from off-the-shelf and third-party software matters because the entity carries responsibility for the security of code written on its behalf.
Applies to. The term marks out the software to which the whole of 6.2 applies: 6.2.1 secure development, 6.2.2 developer training, 6.2.3 pre-release code review and 6.2.4 protection against common software attacks. It also drives two later controls: 6.3.2 requires an inventory of bespoke and custom software and the third-party components built into it, and 6.5.1 requires that changes to such software are tested against 6.2.4 before they reach production. Whether the code was written in-house or by a contractor makes no difference to which controls apply.
Example. A regional airline pays an outside agency to build its booking engine to the airline's specification, and its own team writes a small refund tool that reads from the same database. The booking engine is bespoke, the refund tool is custom, and both are the airline's responsibility under 6.2. The agency's involvement can be managed by contract, but the training, review and inventory obligations remain the airline's to demonstrate.
Limits. The term excludes commercial off-the-shelf software and third-party software the entity buys or licenses as is: an operating system, a database engine or a packaged point-of-sale application is not bespoke, even when heavily configured. The line is who wrote the code and for whom, not how large or important the software is. Open-source libraries pulled into an entity's own code are third-party components, tracked in the 6.3.2 inventory rather than reviewed line by line under 6.2.3.