SDLC (Software Development Life Cycle)
PCIComplianceHubLast updated
The process of planning, designing, building, testing, and maintaining software applications. Organizations must follow secure SDLC practices when developing applications that process, store, or transmit cardholder data in order to maintain PCI DSS compliance.
Applies to. Requirement 6 is where PCI DSS v4.0.1 meets the SDLC. Bespoke and custom software must be developed securely, with information security considered at each stage of the lifecycle, developers trained in secure coding, code reviewed before release, and software engineering techniques in use against the common attack classes the standard lists (injection, attacks on data and data structures, cryptography, business logic and access control). The Council's separate Secure SLC Standard is for software vendors seeking listing and is not part of an entity's own PCI DSS assessment.