The standard for payment software, now retired
PA-DSS set security rules for the software that handles card payments, as opposed to the companies running it. The council announced it on April 15, 2008, building on Visa’s earlier Payment Application Best Practices, according to its farewell post. A vendor of a payment application or gateway could have its product assessed and listed by the PCI Security Standards Council, and merchants used that listing as a shortcut when choosing software.
The council ended it. Its PA-DSS page says the standard “is retired as of 28 October 2022 and has been superseded by the Secure Software Standard and the Secure Software Lifecycle Standard”. It adds that “All PA-DSS applications are now expired” and sit in its list of validated payment applications under the heading “Acceptable Only for Pre-Existing Deployments”.
What replaced it
The successor arrived three years before the retirement. In January 2019, the council published the Secure Software Standard and the Secure Software Lifecycle Standard as the PCI Software Security Framework, according to its farewell post on the retirement. The first assesses a piece of payment software. The second sets requirements for how a vendor builds and maintains software, with procedures to validate those practices.
| PA-DSS | Secure Software Standard | Secure SLC Standard | |
|---|---|---|---|
| Status, November 2026 | Retired October 28, 2022 | In force | In force |
| What it covers | A payment application | A piece of payment software, assessed by a Secure Software Assessor and documented in a Report on Validation | A vendor’s software development lifecycle |
| What a buyer can look up | Expired listings, for pre-existing deployments only | Validated Payment Software | Whether the vendor’s lifecycle practices are validated |
For software already running, the council points questions about expired PA-DSS products “to your acquirer or the payment brands.”
A software listing never made the user compliant
The common mistake is to read “PA-DSS certified” in a vendor’s marketing, especially for gateway source code or white-label platforms, as a sign that the buyer’s own setup is approved. It never worked that way, and the claim is now out of date as well.
Card compliance attaches to the company that handles the data. Visa’s compliance page says PCI DSS compliance “is required of all entities that store, process or transmit Visa cardholder data”. A business that runs licensed payment software on its own servers still needs its own assessment, whatever validation the software carries.
If a vendor quotes a PA-DSS listing, ask for the current Secure Software Standard listing instead, and ask your acquirer which assessment your own deployment will need.