The PCI Software Security Framework (SSF) is a collection of standards and programs for the security of payment software design and development. Payment software security is a crucial part of the payment transaction flow and is essential to facilitate an accurate and reliable flow of payment transactions.
The SSF Framework replaces the data security standard for payment applications (PCI SSS) with modern requirements that support a broader range of types, technologies, and payment software development methodologies. With its outcome‑based approach, the SSF provides developers with greater agility to incorporate security into payment applications using agile development practices and frequent update cycles.
The SSF enables faster delivery of customization and features for payment applications for merchants without compromising security. It also improves consistency and transparency in payment application testing, raising validation assurance for merchants, service providers, and acquirers who implement and manage payment solutions.
It is composed of the following standards:
Compliance Environment Analysis
The objective of this phase is to understand the characteristics of the application(s) that will be within scope, in relation to the transmission, processing, or storage of card data, and to define the environment that must be protected. Therefore, it will be necessary to identify the impact environment of the Security Framework, define boundaries, and obtain the necessary high‑level process information, acquiring as much as possible a picture of the real environment.
This phase will also allow the identification of relationships with third parties (service providers) and how they influence PCI SSS compliance.
After understanding the compliance environment, the information obtained will be validated against the requirements established by the PCI SSS Framework to verify the compliance status of the application(s).
Preparation of the Compliance Status Report and Action Plan
The final report will be drafted showing the current situation, and an Action Plan recommended by Internet Security Auditors will be proposed for full alignment with the Security Framework defined by SSS.
This phase is fed by all previously obtained information, where data transmission flows, main processes, as well as repositories and devices where payment card information is stored, handled, or processed will be defined.
This final report will include the following main points:
- Executive Summary
- Methodology Used
- Definition of the Compliance Environment
- High‑level network diagrams and card data flows
- Current compliance status
- Action Plan to achieve alignment in the application(s).
- Recommendations may also be included to be addressed in the corresponding projects.
PCI SSS Compliance Certification Audit
It is crucial for proper compliance with PCI SSS requirements that the audit environment is correctly identified and meets all requirements defined in Appendix B of the ROV Reporting Template.
The audit plan will be executed, carrying out the evaluation of the controls implemented to meet PCI SSS requirements.
As the final result of the audit, the so‑called Report on Validation (ROV) will be prepared, which will include:
- 1. Description of the Review Scope
- 2. Executive Summary
- 3. Findings and Observations
- 4. Contact Information and Report Date
