56 minutes ago
On February 6, 2026, a ransomware attack hit US payment gateway BridgePay. The outage took down their gateway API and hosted payment pages. Restaurants in Florida went cash-only, and some city offices in Texas lost their payment portals after card transactions flatlined.
Banks and merchants remember these disruptions. The outage did not prove card data was at risk. BridgePay’s initial forensic findings said nothing was compromised. It did show how stuck merchants are when a payment vendor goes down, and that is why risk teams now ask vendors to prove their software and development pipeline are secure.
This blog explains how the PCI Software Security Framework (SSF) works. It covers the two separate standards (Secure Software and Secure SLC), along with the assessment process and the usual trouble spots for engineering teams.
What Is PCI SSF Compliance?
PCI SSF compliance is the process of proving your payment software and your engineering practices meet the PCI Security Standards Council’s security rules. The framework officially replaced the old Payment Application Data Security Standard (PA-DSS) on October 28, 2022.
People often search for PCI SSF certification. The framework calls this result validation. PCI SSC lists validated products and qualified vendors rather than issuing certificates, which is why contracts usually say listed rather than certified. A related PCI compliance test can help organizations evaluate their payment software security controls against applicable PCI requirements.
PA-DSS validated a product at a point in time. SSF splits the problem in two. One standard covers the product. The other covers the vendor’s development lifecycle. Security becomes something you maintain rather than something you pass once.
That change affects how you sell your software.
Who Needs PCI SSF Compliance?
PCI SSF is primarily for software vendors that develop payment software or maintain a payment-relevant development lifecycle. Your need for formal validation depends on the payment-brand rules for your customers, your contracts, and what your buyers require.
If your company only uses the software, your own obligations sit under PCI DSS. Using a payment application does not automatically make you responsible for obtaining its SSF validation. It also does not mean DSS is your only consideration. Your acquiring bank or a customer may still require validated software as a condition of doing business.
Under the latest v2.0 rules, eligibility comes down to what the software actually handles. If your software handles sensitive payment assets, check it against the Secure Software Program Guide. Touching a sensitive asset does not automatically make you eligible.
Source: https://qualysec.com/pci-ssf-compliance/
Banks and merchants remember these disruptions. The outage did not prove card data was at risk. BridgePay’s initial forensic findings said nothing was compromised. It did show how stuck merchants are when a payment vendor goes down, and that is why risk teams now ask vendors to prove their software and development pipeline are secure.
This blog explains how the PCI Software Security Framework (SSF) works. It covers the two separate standards (Secure Software and Secure SLC), along with the assessment process and the usual trouble spots for engineering teams.
What Is PCI SSF Compliance?
PCI SSF compliance is the process of proving your payment software and your engineering practices meet the PCI Security Standards Council’s security rules. The framework officially replaced the old Payment Application Data Security Standard (PA-DSS) on October 28, 2022.
People often search for PCI SSF certification. The framework calls this result validation. PCI SSC lists validated products and qualified vendors rather than issuing certificates, which is why contracts usually say listed rather than certified. A related PCI compliance test can help organizations evaluate their payment software security controls against applicable PCI requirements.
PA-DSS validated a product at a point in time. SSF splits the problem in two. One standard covers the product. The other covers the vendor’s development lifecycle. Security becomes something you maintain rather than something you pass once.
That change affects how you sell your software.
- It is not a legal mandate. No government agency will arrest you for skipping it. The PCI SSC doesn’t force every software company to validate.
- Your clients enforce it. Payment brands like Visa and Mastercard, along with acquiring banks, use the SSF list as a third-party risk filter. If a major processor or merchant won’t install your software without a listing, you need it to close the deal. It is a contract requirement, not a law.
Who Needs PCI SSF Compliance?
PCI SSF is primarily for software vendors that develop payment software or maintain a payment-relevant development lifecycle. Your need for formal validation depends on the payment-brand rules for your customers, your contracts, and what your buyers require.
If your company only uses the software, your own obligations sit under PCI DSS. Using a payment application does not automatically make you responsible for obtaining its SSF validation. It also does not mean DSS is your only consideration. Your acquiring bank or a customer may still require validated software as a condition of doing business.
Under the latest v2.0 rules, eligibility comes down to what the software actually handles. If your software handles sensitive payment assets, check it against the Secure Software Program Guide. Touching a sensitive asset does not automatically make you eligible.
Source: https://qualysec.com/pci-ssf-compliance/