Under this principle, CLAI PAYMENTS® Technologies works under the guidance of the PCI Security Council, the entity that brings together all data security standards for the payment card industry, which arose from the need for large companies to harmonize their rules and operate securely through four pillars: knowledge sharing, evolution of standards, secure channels and alignment of standards to the industry.
In this new update, it is concluded that a single model is not enough to cover the requirements of the payment industry, therefore, it formulated the Software Security Framework (SSF), under which the Secure Software Standard (SSS) and the Secure Software Lifecycle Standard are covered.
In CLAI PAYMENTS® Technologies our work is aimed at generating valuable tools that help avoid risk in payment platforms, so we have decided to undertake the process of renewing our certification, welcoming the secure software standard (PCI-SSS), evolving hand in hand with international guidelines with new technologies and methodologies more focused on the objectives and more flexible at the educational level.
Why is the transition important and relevant at this time?
The PCI PA-DSS standard, to which CLAI PAYMENTS® Technologies adheres to this day, was launched in 2008 with the aim of protecting the applications that adhere to the rule and, in a similar way, the sensitive data of the cardholders associated with them. At the time, this model was applied in response to the needs that needed to be met in the industry: traditional software security requirements, firewall configuration, tracking of network resources, regular testing of security systems and processes, inter alia.
Although the standard was still working properly after 11 years of being the model to follow in the industry, several of the largest financial companies in the world began to offer suggestions for its operation, which led to the need to create the PCI-SSF (Software Security Framework) standard in 2019. Since then, PCI has been working to gradually introduce this new standard, while PA-DSS remained active and supported until October 28, 2022, which generated the final step towards this new version.
What does this change mean for the industry and what are the main differences between PA-DSS and PCI-SSF?
Initially, the change has occurred through a transitional phase wherein PA-DSS is only valid in pre-existing implementations, however, as of October 2022 the PCI SSF completely replaced the previous standard with the objective of promoting security practices that can support traditional methods and also the latest practices in software development of certified companies.
Key differences included in PCI-SSF involve expediting the provision of customization and features for payment applications to merchants without compromising security, as well as improving consistency and transparency in payment application testing, which raises the assurance of validation for both service providers such as CLAI PAYMENTS® Technologies, as well as the customers who purchase and deploy them in their payment ecosystems.
What are the implications of this process and what is our commitment as a company?
Our work continues to be the same: to generate security in the payment platforms of our customers, therefore, our human capital is committed to be part of the certification process and compliance with it through a joint work, maintaining these directions through constant work and efficiency of our processes. That is why our leading solution in the market, AZ7® already has the PCI SSS certification, provided by the PCI Council.
If you wish to learn more and contact our specialized team, leave us your contact information here.
