Deciding Between PCI DSS or SSLC When Evaluating Software Development
If you are a software developer and you want to be assessed against the PCI-DSS, maybe the secure software lifecycle under the SSF is a better choice for you. Let's talk about why.
Hi, I'm Sully Perella, manager here at Schellman, and we're here to discuss the SSLC or secure software lifecycle in comparison to the PCI-DSS and its evaluation of software development practices. As a software development firm, writing code may be bespoke for different organizations. You may have been asked to complete a PCI-DSS assessment against those development practices.
Conversely, your organization is able to complete a secure software lifecycle assessment under the secure software framework or SSLC under the SSF. If you like acronyms, all of these assessments are for you. When comparing the two, almost all of the requirements will seem pretty much in alignment, but there are differences and the benefits of doing the latter (the SSLC) are more apparent when you think about how your organization can be listed on the PCI SSC website for two years as a result of that assessment versus one year under the AOC that your organization would need to provide upon request.
Do you have questions about software development practices, listing, assessments, and how this can impact your business? Please reach out to us, we'd love to answer them.
About Sully Perella
Sully Perella is a Senior Manager at Schellman who leads the PIN and P2PE service lines. His focus also includes the Software Security Framework and 3-Domain Secure services. Having previously served as a networking, switching, computer systems, and cryptological operations technician in the Air Force, Sully now maintains multiple certifications within the payments space. Active within the payments community, he helps draft new payments standards and speaks globally on payment security.