PA DSS (Payment Application Data Security Standard) is the Payment Application Data Security Standard set by the PCI SSC.
The Payment Application Data Security Standard (PA-DSS) is a global security standard created by the Payment Card Industry Security Standards Council (PCI SSC).
Even if you do not need to comply with PA DSS, whether you do not develop your own payment applications or you buy applications from a vendor, you should not overlook the information in PA DSS.
We can list the reasons for this as follows:
- PA DSS can be used by an assessment team to validate the payment application of a payment provider (acquirer). Although the SSC maintains a list of validated payment applications, a partner’s payment application may not be on the list, or companies may want to carry out their own independent audit of a payment application. In such cases, PA DSS is an important audit and assessment guide.
- PA DSS is a detailed review of developing secure payment applications, and it should be used by internal development and security teams to ensure that the applications they develop are designed and deployed with the protection of card data in mind.
PCI DSS covers the entire cardholder data environment ecosystem; it addresses the security of payment applications but does not go into the detail that PA DSS does. Using PA DSS as a guide even for internal applications gives the development team additional guidance.
One example is PA DSS requirement 5.1.5: Secure source control practices are implemented to verify the integrity of source code during the development process. Source code control is an important part of a secure SDLC and is called for in standards such as NIST 800-64.
Another example is Requirement 5.1.6.1: coding techniques include documentation of how PAN and/or SAD are handled in memory. Again, this is an important aspect of payment application security, but it is not explicitly stated in Requirement 6 of PCI DSS (which addresses applications).
There are many more examples in PA DSS. Even if a payment application is not being developed for sale, it should be considered that PA DSS is a valuable document for coding, security and testing teams to review and use when developing a secure payment application.
