Programs Open for Software Security Framework Assessors in October

Starting October, the PCI Security Standards Council will start accepting applications from companies and individuals that are interested in becoming payment software security assessors under the Council's new Software Security Framework (SSF).

The assessors will be responsible for ensuring that vendors are compliant with the requirements of the Secure Software Lifecycle standard and that their software meets the requirements of the Secure Software standard.

PCI SSF is a set of standards and programs for payment card security that will replace the current Payment Application Data Security Standard (PA DSS) in 2022. The SSF will incorporate elements of PA DSS as well as standards and approaches for a broader array of payment software, technologies, and development methods. The Council has described the SSF as embodying a new approach for ensuring the security of new and emerging payment software and channels.

"Goals for the Software Security Framework include allowing for more agility in the security testing, expanding the potential types of applications that go through validation, increasing application developer awareness of payment security design and accountability," says Troy Leach, CTO of PCI SSC, in comments to Dark Reading.

Covered entities will eventually need to ensure their software is validated to SSF requirements if they want to remain compliant with PCI requirements. But that won't happen immediately. To minimize disruption, the Council will run the SSF in parallel with PA-DSS for some time. Applications will continue to be accepted for PA-DSS validation through mid-2021, according to the Council.

Image source: Troy Leach, CTO, PCI SSC