Open-source Software
PCIComplianceHubLast updated
Software whose source code is made available to the public, allowing users to view, modify, and distribute the software. While open-source software can offer cost and flexibility benefits, it is important to ensure that any open-source software used within the cardholder data environment is secure and compliant with PCI DSS requirements.
Applies to. PCI DSS v4.0.1 does not distinguish open-source from commercial software. Open-source components are third-party software, so the vulnerability identification process under Requirement 6 must cover them alongside operating systems and databases, with each vulnerability risk-ranked and the high-risk or critical ones identified. Where open-source libraries are built into bespoke and custom software, general practice is to keep an inventory of those components so their vulnerabilities and patches can be tracked.
Limits. Public source code does not substitute for the vulnerability process; the standard asks the same of software whether or not its source is public.
Related. Third-Party Software, Vulnerability Management, Patch, Bespoke and Custom Software, Commercial Off-the-Shelf (COTS)
Sources. PCI DSS v4.0.1 (June 2024)