Software Security Framework (SSF)
PCIComplianceHubLast updated
The PCI Security Standards Council framework that replaced PA-DSS on 28 October 2022. It comprises two standards: the Secure Software Standard, which validates a payment software product, and the Secure Software Lifecycle Standard, which validates the vendor development process. The framework is designed to accommodate modern development practices such as continuous delivery, which PA-DSS, built around discrete versioned releases, handled poorly.
Applies to. No PCI DSS v4.0.1 requirement names the Software Security Framework; it sits beside PCI DSS as the Council's programme for payment software, with the Secure Software Standard validating a product and the Secure SLC Standard validating the vendor's development practice, each with its own Council listing. A merchant meets it when choosing or defending third-party payment software under Requirement 6; a vendor meets it when a customer or acquirer asks for a listed product. A listing on either register does not make the merchant that deploys the software compliant, since the merchant's own assessment still covers how it is installed, configured and maintained.