PA-DSS (Payment Application Data Security Standard) was the PCI Security Standards Council's security standard for off-the-shelf payment software sold to merchants, such as POS applications and payment modules. Originating as Visa's Payment Application Best Practices and taken over by the council in 2008, it aimed to stop commercial software undermining merchants' PCI DSS compliance, for instance by logging full track data or shipping default passwords. Payment Application Qualified Security Assessors validated applications. The standard is retired: new submissions stopped in 2021, the validated list expired on 28 October 2022, and the PCI Secure Software Standard under the Software Security Framework replaced it. Acquirers now treat legacy PA-DSS software as unvalidated.
What is PA-DSS
PA-DSS began as Visa's Payment Application Best Practices (PABP) and was taken over by the PCI Security Standards Council in 2008. Its purpose was narrow: stop commercial payment software from undermining a merchant's PCI DSS compliance. Many card breaches in the 2000s came from POS software that quietly logged full track data or shipped with default passwords.
Validation was done by a Payment Application Qualified Security Assessor (PA-QSA), and passing applications were listed on the PCI SSC website, where merchants and acquirers could check them.
What does PA-DSS cover
The standard applied to payment applications sold, distributed or licensed to third parties that stored, processed or transmitted cardholder data during authorization or settlement. It did not cover software built in-house for a single merchant, which was assessed under PCI DSS directly.
Its main requirements included:
- Not retaining sensitive authentication data (full track, CVV, PIN block) after authorization, including in logs and debug files.
- Protecting any stored primary account number with strong cryptography and sound key management.
- Unique user IDs and strong passwords, with no vendor default accounts.
- Logging of access to cardholder data.
- Secure remote access and secure delivery of updates.
- An implementation guide telling merchants how to install the software compliantly.
Using a validated application did not make a merchant compliant. A PA-DSS listed POS installed on an unpatched Windows machine with remote desktop open to the internet still failed PCI DSS.
Why PA-DSS was retired
PA-DSS was written around installed software with long release cycles. It fit poorly with cloud services, continuous deployment and mobile apps. Its last version, 3.2, was published in 2016, and PCI SSC stopped accepting new PA-DSS submissions in 2021.
What replaced it
The Software Security Framework, introduced in 2019, has two parts:
- PCI Secure Software Standard: validates the security of a specific payment product.
- PCI Secure SLC Standard: validates a vendor's software development lifecycle, so qualified vendors can self-attest updates without a full reassessment.
PA-DSS in due diligence
Software validated under PA-DSS still runs in many merchant estates, but it is no longer listed, and acquirers and QSAs now treat it like any unvalidated application. When buying a payment business that relies on legacy POS or gateway software, check whether the vendor has moved to the Secure Software Standard or plans to.