PCI Secure Software Framework

What is the PCI Software Security Framework?

The PCI Software Security Framework is the PCI Security Standards Council’s set of standards for software vendors. It replaced the Payment Application Data Security Standard (PA-DSS), which has been retired. It has two parts:

• the Secure Software Standard, which sets security requirements for a software product itself;
• the Secure Software Lifecycle (Secure SLC) Standard, which sets requirements for how a vendor designs, builds, tests and maintains its software.

A vendor can have its products validated against the first, and its development processes validated against the second. Validated products and qualified vendors are listed on the PCI SSC website, which merchants and acquirers use when choosing software.

What changed in 2026?

Both standards reached version 2.0 in 2026:

• Secure Software Standard v2.0 (January 2026) moves away from the narrow idea of “payment software” to protecting sensitive assets: sensitive data, resources and functions. A new Sensitive Asset Identification document supports this. The wider scope means software development kits can be assessed, and the Council intends v2.0 to replace the PCI 3DS SDK Standard in time. Allowed cryptography now matches PCI DSS’s definition of strong cryptography.
• Secure SLC Standard v2.0 (September 2026) aligns with the new Secure Software Standard, focuses only on the vendor’s lifecycle, and adds requirements on digital tools, including the use of AI in development.

A 12-month transition from the earlier versions will start once training for assessors is available, which the Council planned for the end of 2026.

Who does it apply to?

Software vendors whose products handle payment data or support payment security, when their customers or the payment brands expect validated software. It isn’t law: it applies through the requirements of acquirers, payment brands and customers.

How does it relate to other frameworks?

PCI DSS applies to organisations that store, process or transmit account data, while the Software Security Framework applies to the vendors that make the software. Using validated software doesn’t make a merchant PCI DSS compliant, but it helps, because the software’s own security has been checked.