PA-DSS (Payment Application Data Security Standard)
PCIComplianceHubLast updated
A retired standard that set security requirements for commercially sold payment applications handling cardholder data. PA-DSS closed on 28 October 2022 and was replaced by the PCI Software Security Framework, made up of the Secure Software Standard and the Secure Software Lifecycle (Secure SLC) Standard. Applications previously validated under PA-DSS moved to an acceptable-only-for-pre-existing-deployments list, and all new validations are performed under the Software Security Framework.
Applies to. No PCI DSS v4.0.1 requirement names PA-DSS, and the Council has superseded it with the Software Security Framework; applications validated under PA-DSS now appear on the Council's list as acceptable only for pre-existing deployments, and new validations are made under the Secure Software Standard. A merchant meets the term when choosing or defending third-party payment software under Requirement 6, which asks how such software is kept patched and how the merchant's own bespoke and custom software is developed. A past PA-DSS validation is evidence about the software's design, not about the merchant's compliance, which still turns on how the software is installed, configured and maintained.