Secure SLC (Secure Software Lifecycle Standard)
PCIComplianceHubLast updated
The half of the PCI Software Security Framework that assesses how a vendor builds software rather than the finished product: threat modelling, secure design, code review, vulnerability management and change control across the development lifecycle. A vendor with Secure SLC qualification can self-attest to certain low-impact changes without a full reassessment of the product, which is what makes frequent release cycles workable under the framework.
Applies to. No PCI DSS v4.0.1 requirement names Secure SLC; it is a standard for software vendors, assessed by Council-qualified Secure SLC assessors, not for merchants. The same ground for an entity that writes its own payment software is Requirement 6, which asks for a documented development process, secure coding training and code review of bespoke and custom software, and a Secure SLC assessment is one way a vendor evidences those practices to its customers. A vendor with a Secure SLC listing can self-attest low-impact changes to its Secure Software Standard products instead of returning to an assessor for each release, which is what lets frequent releases stay validated.