PCI Secure Software Lifecycle Standard eligible for more software vendors

3. March 2021

Recently the PCI Security Standards Council (PCI SSC) released version 1.1 of the Secure Software Lifecycle (Secure SLC) Standard and the corresponding Program Guide. This company certification out of the PCI Software Security Framework (PCI SSF) allows software vendors to prove that they have integrated comprehensive security measures into their complete software lifecycle.

Our accredited Secure SLC assessors have reviewed the key changes compared to the original version for you:

The majority of the changes were made to correct minor errors and to sharpen definitions and important terms. But the following expansion of the definition, concerning the eligibility, has exciting implications.

For purposes of this document (including Section A.3 of Appendix A hereto):
“Eligible Software” means any software or software component that may be present in a payment environment and either (a) is directly involved in storing, processing, or transmitting payment data (“Payment Software”) or (b) does not directly handle payment data but may share resources defined within a payment environment;

[Source: https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Program-Guide-v1_1.pdf]

The standard is therefore no longer limited to providers of payment software that directly stores, processes or transmits payment data. The addition of part (b) will make it easier for other software vendors to participate in the Secure SLC program and achieve validation according to it.


Do you have questions about a certification according to the PCI Secure Software Lifecycle Standard or do you need support? Contact us, we are happy to help.

Also interesting:

usd PCI Best Practice Workshop 2021

usd PCI Best Practice Workshop 2021

For many years, the usd PCI Best Practice Workshop has brought together responsible PCI personnel from companies of all sizes and from all industries to discuss current topics from the world of payment card industry together with PCI experts from usd. The interactive...

3 Reasons for a Cloud Security Audit

3 Reasons for a Cloud Security Audit

Outsourcing applications and data to the cloud brings significant benefits for companies, but at the same time also new challenges for the corresponding IT departments. The technologies and processes of a cloud environment differ from those of local data centers....

usd HeroLab Top 5 Vulnerabilities 2020: SMB 1.0 & SMB Signing

usd HeroLab Top 5 Vulnerabilities 2020: SMB 1.0 & SMB Signing

During penetration tests our security analysts repeatedly uncover gateways in IT systems and applications that pose significant risks to corporate security. They increasingly identify the same vulnerabilities in different IT assets, some of which have been known for...

Categories

Categories