A Tribute to a Foundational Standard | Relic Tech


On 28 October 2022, the PCI Safety Requirements Council (PCI SSC) formally retired its Fee Software Information Safety Normal (PA-DSS). As one of many first requirements and applications of its type, PA-DSS laid the groundwork for software program safety within the cost {industry} and has served the cost {industry}’s wants for greater than 14 years.


As cost {industry} wants have advanced, so too has the strategy to software program safety requirements. An modern strategy – the PCI Safe Software program Normal – was wanted to assist fashionable cost software program architectures and software program improvement methodologies, and to guard cost software program from more and more advanced software program assaults.

by the numbers-2Whereas we transfer ahead with the subsequent evolution of cost software program safety by the PCI Software program Safety Framework requirements, the Council wish to take this second to pay tribute to PA-DSS, one of many authentic, foundational cost safety requirements of the group and of the {industry}.

On this tribute video, present and former staff of the PCI Safety Requirements Council bid farewell to PA-DSS and replicate on what the usual has meant to them over the past 14 years.

The video options two staff who have been instrumental within the improvement and implementation of PA-DSS and its program in 2008; former Normal Supervisor of the Council, Bob Russo (now retired), and the Chair of PCI SSC’s Technical Working Group, Lauren Holloway (now Director of Information Safety Requirements at PCI SSC).

Additionally featured within the video are:

  • Marc Bayerkohler, Requirements Coach, PCI SSC
  • Brandy Cumberland, Director Program High quality, PCI SSC
  • Elizabeth Terry, Senior Supervisor Neighborhood Engagement, PCI SSC
  • Tom White, Senior Supervisor Content material Growth, PCI SSC

Historical past

PA-DSS, introduced on April 15, 2008, was previously created by Visa Inc., and generally known as the Fee Software Greatest Practices (PABP). It was created to assist software program distributors and others develop safe cost functions that don’t retailer prohibited knowledge, and assist compliance with PCI DSS (Information Safety Normal).

Fee functions adhering to PA-DSS minimized the potential for safety breaches and the resultant fraud. Different parts of the PA-DSS program have been rolled out following the publication of the usual, together with the necessities and coaching program for PA-QSAs (Fee Software Certified Safety Assessors) and finally the publication of a listing of validated cost functions.

Endorsed by the 5 PCI Taking part Fee Manufacturers on the time – American Specific, Uncover, JCB Worldwide, Mastercard and Visa Inc. – PA-DSS helped the PCI Safety Requirements Council to satisfy its strategic mission: to develop and keep world, industry-wide safety requirements for the safety of cost account data all through the cost transaction lifecycle.

PA-DSS was transformational to each the Council and to the {industry}. With the Council’s adoption of PA-DSS, there was now a single entity managing world requirements and streamlining necessities associated to cost knowledge safety, which included the PCI DSS and the PCI PED (PIN Entry Gadgets) Safety Necessities. By adopting PA-DSS, the Council established a standard basis for widespread adoption of safe cost functions.

From all of us on the Council, we thanks, PA-DSS, for serving the {industry} nicely, and we congratulate you in your well-deserved retirement!

The Future: The Software program Safety Framework

In January 2019, PCI SSC revealed new necessities for the safe design and improvement of contemporary cost software program. The PCI Safe Software program Normal and the PCI Safe Software program Lifecycle (Safe SLC) Normal are a part of the PCI Software program Safety Framework (SSF), which features a validation program for software program distributors and their software program merchandise and a qualification program for assessors.

The PCI Safe Software program Normal expands on the important thing rules of defending cost functions and knowledge that have been first launched in PA-DSS, and is designed to assist a a lot bigger set of cost software program architectures, capabilities, and software program improvement methodologies.

The PCI Safe SLC Normal gives safety necessities and evaluation procedures for software program distributors to combine into their software program improvement lifecycles and to validate that safe lifecycle administration practices are in place.

For extra data on how the PCI Software program Safety Framework builds on PA-DSS to take cost software program validation ahead, go to our weblog posts:

Everybody interested by studying extra in regards to the Software program Safety Framework requirements is inspired to attend SSF Information Coaching. New this 12 months, Information Coaching programs are designed to bridge the information hole between organizations and assessors by offering studying alternatives for people to take the identical coaching and examination because the Assessor. Information Coaching is obtainable for each the Safe Software program Lifecycle (Safe SLC) Assessor course in addition to the Safe Software program Assessor course.


PCI SSC is providing PA-DSS Distributors a particular low cost for Information Coaching in 2023. If you’re a PA-DSS Vendor, please contact the PA-DSS Program Supervisor for particulars on tips on how to benefit from this particular supply.

Additionally on the weblog: Watch and Be taught All About Information Coaching

Register for Software Security Framework Knowledge Training


A Tribute to a Foundational Standard