PCI SSF · Software Security Framework

Compliance and Certification
PCI SSF

The PCI Software Security Framework (SSF) is a collection of standards and programs for the security of payment software design and development. Payment software security is a crucial part of the payment transaction flow and is essential for facilitating an accurate and reliable flow of payment transactions.

Phase 1, Environmental Analysis
Compliance environment assessment
Phase 2, Report and Action Plan
Current status and roadmap
Phase 3, Certification Audit
Validation Report (ROV)
Phase 4, Gap Analysis v2.0
Transition from SSS v1.2.1 to v2.0
The frame

What is PCI SSF?

The PCI Software Security Framework (SSF) is a collection of standards and programs for the security of payment software design and development. Payment software security is a crucial part of the payment transaction flow and is essential for facilitating an accurate and reliable flow of payment transactions.

The SSF replaces the Payment Application Data Security Standard (PCI PA-DSS) with modern requirements that support a wider range of payment software types, technologies, and development methodologies. With an outcome-based approach to its requirements, the SSF provides developers with more agility to incorporate security into payment applications using agile development practices and frequent update cycles.

The SSF enables faster delivery of customization and features for merchant payment applications without compromising security. It also improves consistency and transparency in payment application testing, which increases validation assurance for merchants, service providers, and acquirers that implement and manage the use of payment solutions.

It is comprised of the following standards:

Secure Software Standard (SSS): The Secure Software Standard provides security requirements for the design of secure payment software to protect the integrity and confidentiality of sensitive data that is stored, processed, or transmitted in connection with payment transactions. It is intended for vendors that develop payment software that supports or facilitates payment transactions.

Secure Software Lifecycle Standard (SSLCS): The Secure Software Lifecycle Standard provides security requirements for payment software vendors to integrate security throughout the software lifecycle, resulting in software that is secure by design and capable of resisting attacks. It is intended for vendors that are developing payment software that supports or facilitates payment transactions.

Scope

Who does PCI SSF affect?

Any organization that participates in the processing, transmission, or storage of payment card information is subject to compliance with the requirements established by PCI DSS, and may be eligible to certify its applications and/or processes through the PCI SSF Framework.

Our services

How we work

01Compliance Environment Analysis
The objective of this phase is to understand the characteristics of the application(s) that will be in scope, in relation to the transmission, processing, or storage of card data, and to define the environment that must be protected. Therefore, it will be necessary to identify the security framework's impact environment, define boundaries, and obtain the necessary information regarding high-level processes, capturing a snapshot of the actual environment as much as possible.

This phase will also allow for the identification of relationships with third parties (service providers) and how they influence PCI SSS compliance.

After understanding the compliance environment, the information obtained will be validated against the requirements established by the PCI SSS Framework in order to verify the compliance status of the application(s).
02Preparation of the Compliance Status Report and Action Plan
The final report will be drafted, showing the current situation and proposing an Action Plan recommended by Internet Security Auditors for full compliance with the Security Framework defined by SSS.

This phase draws on all information obtained previously, in which data transmission flows, main processes, as well as the repositories and devices where payment card information is stored, handled, or processed, will be defined.

This final report will contain the following main points:
  • Executive summary
  • Methodology used
  • Definition of the Compliance Environment
  • High-level network diagrams and card data flows
  • Current compliance status
  • Action Plan to achieve alignment in the application(s).
Recommendations that may be addressed in the corresponding projects could also be included.
03PCI SSS Compliance Certification Audit
It is crucial for correctly meeting PCI SSS requirements that the audit environment is properly identified and complies with all requirements defined in appendix B of the ROV Reporting template.

The audit plan will be executed, carrying out the assessment of the controls implemented to meet PCI SSS requirements.

As a final result of the audit, the Report on Validation (ROV) will be prepared, which will include:
1. Description of the scope of review
2. Executive Summary
3. Findings and Observations
4. Contact Information and Report Date
04PCI Secure Software Standard v2.0 Gap Analysis
This consulting service is aimed at organizations that have applications certified under the PCI Secure Software Standard v1.2.1 and need to assess their level of alignment with the new and updated requirements of version 2.0 of the standard, with a view to preparing for certification under the new version.

The primary objective of the service is to identify the gaps between the currently implemented controls and the requirements of the PCI Secure Software Standard v2.0, especially considering the structural changes to the standard, the introduction of the concept of sensitive assets, and the new expectations regarding security throughout the software development lifecycle.

The consulting includes a documentary and technical review of the application, development processes, and associated security controls, taking the existing v1.2.1 certification as a baseline. Based on this analysis, the v2.0 requirements are mapped against current controls, identifying partial compliance, gaps, and opportunities for improvement.

As a result, a report is delivered detailing:
  • The current level of compliance against each relevant requirement of the PCI Secure Software Standard v2.0.
  • Practical and prioritized recommendations to close gaps and facilitate the transition to v2.0 certification.
This service allows organizations to plan their adaptation to the new standard in a structured and efficient manner, reducing risks, optimizing efforts, and ensuring the continuity of their applications certified under the PCI framework.
Related Services
PCI DSS Implementation and Certification PCI PIN Implementation and Certification PCI 3DS Audit ISO Management Systems European Regulation Strategy & CISOaaS Continuity & Resilience

Scope of service

What this service covers

Compliance environment analysis

Assessment of applications in scope regarding card data transmission, processing, and storage.

Third-party relations

Identification and assessment of third-party relationships and their impact on the compliance environment.

Network diagrams and data flows

Review of network diagrams and data flows for the compliance environment.

Action and remediation plan

Current status report with recommended action plan for full compliance with the standard.

Validation Report (VR)

Certification audit with issuance of the ROV report including findings, observations, and executive summary.

SSS Gap Analysis v2.0

Gap analysis between current controls and the requirements of version 2.0 of the PCI Secure Software Standard.

Security controls review

Analysis of development processes and review of security controls implemented in applications.

Testimonials

What our clients say

Working with Internet Security Auditors has been a highly satisfactory experience. Their support in migrating to the ISO/IEC 27001:2022 standard, conducting internal audits, and the PCI DSS certification process has been fundamental in strengthening our information security management system.

Ricardo Andrés Cárdenas Galvis
Information Security Office · Neurona

The strategic support of Internet Security Auditors as CISOaaS has been fundamental in strengthening our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance more quickly in the maturity of our cybersecurity.

CISO
RACC

On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.

Yulian Colmenares
Information Security Office · Outsourcing SAS BIC

Working with Internet Security Auditors has been a positive experience in every respect. Their team combines solid technical expertise with a great willingness to work collaboratively, which has strengthened our security posture and regulatory compliance.

Andrés Mejía
Head of GRC · Payválida

As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner for the implementation of the requirements set forth by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…

Victoria Villarreal Palazón
Vice President & Associate VP CFO · Saint Louis University

As CFO of Fleurop-Interflora Spain, we have worked with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a company 100% focused on online commerce, the professional services provided by Internet Security Auditors give us support, security, and peace of mind that all of our activity is aligned with GDPR compliance.

Francisco Tébar Prada
CFO Southern Europe · Fleurop - Interflora Spain

As CISO at Intaremit S.A., we place the highest importance on logical security. This is not only due to the mere fact that PCI-CPP regulations require us to perform four internal and external vulnerability scans and an annual internal and external pen test, but also because of the security and peace of mind our company wants to provide to each and every one of its clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; therefore, I recommend them without hesitation.

Sergio Sainz de la Maza
CISO · Intaremit

At Grupo Arbulu, we have worked closely with Internet Security Auditors to implement advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.

Marcos Montes de Oca
CIO · Arbulu Group

As CEO of Beruby, we worked with Internet Security Auditors when we had to urgently complete a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.

Miguel Acosta
Global CEO · Beruby

At Grupo AR, we highly value the brand protection service provided by Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team allows us to identify and mitigate risks that could affect the AR Construcciones brand and its various companies.

Nestor Ivan Melo Ballen
Cybersecurity Director · AR Group

Frequently Asked Questions

We answer your questions

What is PCI SSF and how does it differ from PA-DSS?

PCI SSF (Software Security Framework) is the framework that replaces PA-DSS with modern requirements for payment software security. Unlike PA-DSS, the SSF supports agile development practices, frequent update cycles, and provides greater flexibility for developers to incorporate security into their applications.

What is the difference between SSS and SSLCS?

The Secure Software Standard (SSS) focuses on the security requirements of the payment software itself, protecting the integrity and confidentiality of sensitive data. The Secure Software Lifecycle Standard (SSLCS) focuses on development processes, ensuring that security is integrated throughout the entire software lifecycle.

To whom does the PCI SSF certification apply?

It applies to manufacturers that develop payment software that supports or facilitates payment transactions, as well as to any organization involved in the processing, transmission, or storage of payment card information.

What is the Report on Validation (ROV)?

The ROC is the document resulting from the PCI SSS certification audit. It includes a description of the review scope, an executive summary, detailed findings and observations, and contact information and date. It is the official report that certifies compliance.

What does the Gap Analysis for version 2.0 include?

The Gap Analysis service is aimed at organizations with applications certified under PCI SSS v1.2.1 that need to evaluate their alignment with version 2.0. It includes document and technical reviews, analysis of development processes, requirements mapping, identification of gaps, and prioritized recommendations to facilitate the transition.

Contact

Do you need to certify your payment software under PCI SSF?

Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.

R
Ricardo Andrés Cárdenas
2 months ago

Working with Internet Security Auditors has been a highly satisfactory experience. Their support in the migration to ISO/IEC 27001:2022 and the PCI DSS certification process has been fundamental in strengthening our ISMS.

A
Andrés Mejía
3 months ago

Your team combines solid technical expertise with a strong willingness for collaborative work, which has strengthened our security posture and regulatory compliance.

V
Victoria Villarreal Palazón
4 months ago

They have been our indispensable partner for the implementation of GDPR requirements. I would highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions.

M
Miguel Acosta
5 months ago

The entire PCI DSS Attestation of Compliance process was extremely fast, efficient, and professional. We undoubtedly recommend their services to any company in need of cybersecurity solutions.

S
Sergio Sainz de la Maza
6 months ago

We have been working with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility. I recommend them without hesitation.

Request information

We will be in touch with you as soon as possible.
Global Presence

Our offices

Barcelona

C. Santander, 101. Building A-2
E-08030 Barcelona (Spain)

+34 93 305 13 18
Madrid

Arequipa St., 1
28043 Madrid (Spain)

+34 91 763 40 47
Bogotá

Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)

+57 601 638 68 88
25
years of experience in cybersecurity
Contact us