Cyber Correlate

Englishالعربية Soon
Under attack?
PCI-S3 · Secure Software Standard

Getting your payment software listed means proving what it does with data in memory.

Validation against the PCI Secure Software Standard, from kickoff through gap assessment, forensic analysis and final audit, to a Report on Validation submitted to the council and an application listed on the PCI SSC portal.

Required before you start
Application penetration testing, validated
Secure code review, validated
Security Guidance Document
SDLC documentation
Data flow diagram

Penetration testing and secure code review are mandatory for S3 certification, and current validated reports must be available during the audit. Vendors who arrive without them lose the first month.

Methodology

Six phases, and the third one is where the work is

Kickoff and documentation are administrative. Gap assessment is where the application is actually taken apart, and where the 30 to 90 day remediation window is decided.

01

Kickoff call

Stakeholders aligned on the validation process: a project plan with tentative dates, a detailed discussion of scope, the designated point of contact introduced, and the complete listing process walked through end to end.

02

Prerequisite documentation

Roughly 34 documents are required. Gap assessment cannot begin without the Security Guidance Document covering the twelve control objectives and three modules, the SDLC document, and the data flow diagram.

03

Gap assessment

Four sub-phases, and the part where most vendors discover what the standard actually demands of them.

a
Application walkthrough

Functionality, data handling, user management and encryption methods examined against the prerequisite documents.

b
Manual code review

Source code review points drafted against the S3 control objectives, with developer assistance required to evidence them.

c
Forensic analysis

Successful and unsuccessful test transactions, RAM extraction and scanning of volatile and non-volatile memory with forensic tooling, and network packet capture.

d
Database and log review

Database examined after the test transactions alongside application and server logs, with captured network packets analysed.

An action tracker follows the gap assessment: every point that does not meet the standard, the sub-requirement it maps to, and a recommended resolution.

04

Revalidation

A tentative remediation timeline agreed, each action point and its recommendation discussed, and closure validated. Typical remediation window is 30 to 90 working days.

05

Final audit

The application deployed on every operating system intended for listing, readiness confirmed on each, and forensic analysis performed across all of them. Documentation begins only once no gaps remain.

06

Certification

Report on Validation and Attestation of Validation prepared, each through two levels of internal review, then submitted to the PCI portal for pre-screening, programme manager approval and assessor review.

After submission

The council’s review is its own timeline, and it is not short

Five stages sit between a completed audit and a listed application. Each review iteration carries a 30 working day service level, which is why getting the documentation right the first time matters more here than almost anywhere else.

01
Payment to PCI SSC
The listing fee is paid to the council by the vendor as part of the process.
02
Pre-screening
Documents uploaded to the portal are pre-screened, then approved by the PCI programme manager before entering review.
03
Under review
The council reviews the ROV, AOV, VRA and supporting vendor documents. Service level is 30 working days per iteration.
04
Feedback
Feedback is addressed and the documents re-uploaded for further review.
05
Passed
On approval, the application is listed on the PCI SSC portal within two to three working days.
Output

Deliverables

Two sets. First, the action tracker following gap analysis. Second, the Report on Validation, the Attestation of Validation, and the Certificate of Validation once final certification is complete.

Talk to a consultant →

Lifecycle

Validity and revalidation

A listing is valid for three years, with annual revalidation mandatory throughout. Where nothing has changed, a signed AOV is shared with the council. Where the application has changed, each change is classified as high impact, low impact or administrative and the assessor is informed before the AOV is submitted.

Secure code review →

Related

The two things you must have first

Application penetration testing

Mandatory for S3. A current validated report has to be available during the audit.

Secure code review

Also mandatory, and separate from the manual review performed during gap assessment.

PCI DSS

If you process rather than build, the Data Security Standard is the one that applies.

Find out whether you are ready to start.

A scoping call establishes the application, its functionality, user roles and pages in scope, and whether your mandatory prerequisites are actually in place.