Bespoke and Custom Software
PCIComplianceHubLast updated
The v4.x term for software written for one organization rather than sold off the shelf. Bespoke software is built for the entity by a third party, to specifications the entity sets; custom software is built by the entity for its own use. Both fall under Requirement 6, covering secure development practices, code review, vulnerability management and change control. The distinction from off-the-shelf and third-party software matters because the entity carries responsibility for the security of code written on its behalf.