The PA-DSS and PCI-DSS are designed to help companies protect credit card information and secure payment portals. Because of their similar purpose, separating PA-DSS from PCI-DSS can be a little difficult. It also doesn’t help that both data security compliance standards were created by the same entity—the Payment Card Industry Security Standards Council (PCI SSC).

The PCI SSC is a regulatory board that consists of the five major credit card brands: Visa, Mastercard, Discover, American Express, and JCB. However, it’s not just big brand credit card companies that are a part of the PCI SSC. It also includes financial institutions, merchants, processor companies, software developers, and point-of-sale vendors.

Fortunately, the difference between these mandates is rather straightforward. Once you understand the specifics behind these standards, it should clear up any confusion. Let’s start by first explaining what PA-DSS is.

What Is PA-DSS and When Should PA-DSS Be Applied?

The PA-DSS is a set of requirements that are aimed at helping software vendors develop secure payment applications. The rules stated in the PA-DSS apply to all third-party applications that store, process, or transmit cardholder data as part of an authorization or settlement. The only software that is exempt from these regulations are ones that are built and used internally. However, in-house software is still subject to PCI-DSS compliance.

There are 14 requirements listed in the PA-DSS:

1. Do not retain full magnetic stripe, card verification code or value (CAV2, CID, CVC2, CVV2), or PIN block data.
2. Protect stored cardholder data.
3. Provide secure authentication features.
4. Log payment application activity.
5. Develop secure payment applications.
6. Protect wireless transmissions.
7. Test payment applications to address vulnerabilities and maintain payment application updates.
8. Facilitate secure network implementation.
9. Never store cardholder data on a server connected to the internet.
10. Facilitate secure remote access to the payment application.
11. Encrypt sensitive traffic over public networks.
12. Secure all non-console administrative access.
13. Maintain PA-DSS instructions, documentation, and training programs for customers, resellers, and integrators.
14. Assign PA-DSS responsibilities for personnel, and maintain training programs for personnel, customers, resellers, and integrators.

While many of the rules here align with the PCI-DSS, PA-DSS compliance does not guarantee PCI-DSS compliance.

What Is PCI-DSS?

The PCI-DSS is a set of requirements to ensure that any organization that handles credit card data processes, stores, and transmits that data securely. Launched in 2006, the purpose of the standard is to improve account security throughout the transaction process. The PCI-DSS is the industry’s primary compliance standard.

Since this is a regulation deployed by an organization outside of the local, state or federal government, PCI-DSS is not a law. This means that you are not legally obligated to adopt PCI standards. However, the major card brands demand its use via banks and other organizations that process all credit card transactions. If you fail to comply with PCI-DSS, it could result in your company being unable to accept credit card transactions.

Similar to the PA-DSS, PCI-DSS also outlines its requirements. The 12 listed rules must be followed fully to achieve compliance. These requirements include:

1. Install and maintain a firewall configuration to protect cardholder data.
2. Do not use vendor-supplied defaults for system passwords and other security parameters
3. Protect stored cardholder data.
4. Encrypt transmission of cardholder data across open, public networks.
5. Protect all systems against malware and regularly update anti-virus software or programs.
6. Develop and maintain secure systems and applications.
7. Restrict access to cardholder data by business need-to-know.
8. Identify and authenticate access to system components.
9. Restrict physical access to cardholder data.
10. Track and monitor all access to network resources and cardholder data.
11. Regularly test security systems and processes.
12. Maintain a policy that addresses information security for all personnel.

The main difference between PCI-DSS and PA-DSS is that PCI applies to any company that stores, processes, or transmits cardholder data. While PA-DSS specifically applies to vendors that produce and sell payment applications.

How To Achieve PA-DSS and PCI-DSS Compliance

PA-DSS compliance begins with an audit. A PA-DSS Qualified Security Assessor must perform an audit on the application you developed. During the assessment, the assessor makes sure that your application follows all requirements.

The PCI-DSS compliance process is slightly more complicated. Every merchant is classified into different levels depending on the number of transactions you process per year. While the brand of the card used during these transactions can influence the level, assessment requirements remain consistent across all levels.

Assessing PCI-DSS compliance depends not only on the level your business falls into but also on the type of business you are performing. Additionally, who audits your business and the level of detail of that audit is determined by your merchant level.

Here are the three types of assessors that generally perform the audit:

• Qualified Security Assessor: This is a third-party assessor who has been certified by the PCI Security Council to perform PCI assessments. They perform assessments for all Level 1 merchants.
• Internal Security Assessor: This is an assessor who resides internally in your organization. The ISA has to be certified by the PCI Security Council to perform PCI assessments.
• Self-Assessment Questionnaire: The self-assessment questionnaires are used by lower-level merchants to perform a self-assessment.

Let Us Help You Become PCI Compliant

If you need to reach PCI-DSS compliance, the experts at Third Wave Innovations can help. From helping you build a secure network to identifying and mitigating vulnerabilities, we get your company ready for your audit.