PA-DSS

For a payment application to be deemed PA-DSS compliant, software vendors must ensure that their software includes the following fourteen protections: • Do not retain full track data, card verification code or value (CAV2, CID, CVC2, CVV2), or PIN block data. • Protect stored cardholder data. • Provide secure authentication features. • Log payment application activity. • Develop secure payment applications. • Protect wireless transmissions. • Test payment applications to address vulnerabilities and maintain payment application updates. • Facilitate secure network implementation. • Cardholder data must never be stored on a server connected to the Internet. • Facilitate secure remote access to payment application. • Encrypt sensitive traffic over public networks. • Secure all non-console administrative access. • Maintain a PA-DSS Implementation Guide for customers, resellers, and integrators. • Assign PA-DSS responsibilities for personnel, and maintain training programs for personnel, customers, resellers, and integrators. ==Governance and enforcement==

PCI SSC has compiled a list of payment applications that have been validated as PA-DSS compliant, with the list updated to reflect compliant payment applications as they are developed. Creation and enforcement of these standards currently rests with PCI SSC via Payment Application-Qualified Security Assessors (PA-QSA). PA-QSAs conduct payment application reviews that help software vendors ensure that applications are compliant with PCI standards. ==History==

Governed originally by Visa Inc., under the PABP moniker, PA-DSS was launched on April 15, 2008 and updated on October 15, 2008. PA-DSS then became retroactively distinguished as "version 1.1" and "version 1.2". In October 2009, PA-DSS v1.2.1 was released with three noted changes: indicating: Update and implement minor changes from v1.2.1 and align with new PCI DSS v2.0. For details, please see PA-DSS – Summary of Changes from PA-DSS Version 1.2.1 to 2.0. In November 2013, PA-DSS 3.0 was released, indicating: Update from PA-DSS v2. For details of changes, please see PA-DSS – Summary of Changes from PA-DSS Version 2.0 to 3.0. In May 2015, PA-DSS 3.1 was released In May 2016, version 3.2 of the PA-DSS Program Guide and Standards were released. For details, see Summary of Changes from PA-DSS Version 3.1 to 3.2. ==Supplemental information==

The PCI SSC has published additional materials that further clarify PA-DSS, including the following: • PA-DSS Requirements and security assessment procedures. • Changes from past standards. ==References==