TABLE OF CONTENT
PCI S3 certification is how payment software vendors prove their products protect payment data to the standard set by the PCI Security Standards Council (PCI SSC). In January 2026, the PCI SSC released version 2.0 of the PCI Secure Software Standard, changing the scope, documentation and assessment requirements. This blog explains what PCI S3 is, who needs it, how to achieve it and what v2.0 means for your next assessment.
What is PCI S3?
PCI S3 is the PCI Secure Software Standard: the PCI SSC’s security requirements for software that handles payment data or payment-related functions. It sets out how that software must be built and maintained so it protects payment transactions and data, limits vulnerabilities and resists attack.
PCI S3 sits within the PCI Software Security Framework (SSF), which has two standards:
- PCI Secure Software Standard (S3): assesses the security of the software product itself, at product level.
- PCI Secure Software Lifecycle (Secure SLC) Standard: assesses the vendor’s development and maintenance practices, at organization level.
The SSF replaced the Payment Application Data Security Standard (PA-DSS), which closed on 28 October 2022.
Is it really a certification? The PCI SSC calls it validation. A PCI SSC-qualified Secure Software Assessor evaluates the software, and once the PCI SSC accepts the report, the product is listed on the PCI SSC website. In the industry, this is commonly called PCI S3 certification.
Importance of PCI S3 Certification in 2026
2026 is the most significant year for PCI S3 since its launch. On 15 January 2026, the PCI SSC published PCI Secure Software Standard v2.0, its first major revision. The key changes are:
- Sensitive asset-based scope: eligibility now depends on what the software handles, not a “payment software” category. A companion Sensitive Asset Identification document is required.
- Source code access: vendors must provide source code to the assessor.
- Documentation: a software bill of materials and full architecture documentation are mandatory.
- Stronger access controls: sensitive modes, such as administrative or debug access, require multi-factor authentication.
- SDKs in scope: SDKs, including EMVCo 3DS SDKs, can now be assessed. The separate PCI 3DS SDK Standard entered a sunset period on 1 May 2026.
A 12-month transition from v1.2.1 to v2.0 begins once v2.0 assessor training is available, and existing v1.2.1 listings remain valid until further notice. The PCI Secure SLC Standard v2.0 followed on 28 September 2026. For a detailed breakdown of PCI S3 latest revision, read SISA’s guide to what PCI Secure Software Standard v2.0 means for payment software vendors.
Who Needs PCI S3 Compliance?
PCI S3 applies to software vendors whose products store, process or transmit payment data, or support payment functions, for other organizations. Under v2.0, eligibility is driven by the sensitive assets the software handles. Software eligible for PCI S3 validation includes:
- POS and ATM applications
- Tokenization and key management software
- Fraud monitoring software, where it handles sensitive assets
- In-app payment SDKs and 3DS SDKs, newly eligible under v2.0
Merchants and service providers that only use validated software are not in scope; PCI DSS applies to their own environment.
The PCI SSC sets the standard but does not enforce it. In practice, demand comes from payment brands, acquirers, banks and enterprise buyers, who often expect validated software during procurement.
How to Implement PCI S3 Compliance
Achieving PCI S3 certification follows seven steps, from scoping to ongoing maintenance.
- Confirm scope and eligibility. Identify the sensitive assets your software handles, using the PCI SSC’s Sensitive Asset Identification document.
- Run a gap assessment. Compare your software against the v2.0 security objectives to find missing or weak controls.
- Remediate gaps. Fix issues in coding, authentication, cryptography, logging and vulnerability management.
- Prepare documentation. Document the architecture, sensitive asset flows, Software Bill of Materials (SBOM) and implementation guidance for your customers.
- Engage a Secure Software Assessor. The assessor reviews documentation and source code and performs static and dynamic analysis.
- Submit for listing. The assessor submits the report to the PCI SSC. Once accepted, the product appears on the PCI SSC website.
- Maintain validation. Assess the impact of every software change, follow the PCI SSC change process and keep documentation current.
Common Readiness Gaps Under v2.0
- Incomplete sensitive asset flow diagrams
- No cryptographic key inventory or lifecycle controls
- Undefined data retention and deletion logic
- Unsecured administrative or debug modes
- Outdated implementation guidance and SBOM
Benefits of Implementing PCI S3 Compliance
Beyond meeting a PCI SSC requirement, PCI S3 certification brings commercial and security advantages for payment software vendors and their customers. The key benefits include:
- Market access: meet the expectations of acquirers, banks and enterprise buyers that require validated payment software.
- Faster sales cycles: a public PCI SSC listing answers many security questions before procurement begins.
- Lower breach risk: independent testing finds vulnerabilities before attackers do.
- Easier PCI DSS assessments for customers: a PCI SSC listing gives customers independent evidence that the software meets the PCI Secure Software Standard, which supports their PCI DSS assessments. It does not, on its own, reduce their PCI DSS scope.
- Future readiness: aligning with v2.0 now avoids a rushed transition later.
SISA for PCI S3 Compliance
SISA is a PCI SSC-qualified Software Security Framework (SSF) Assessor Company and a forensics-driven payment security specialist. SISA’s assessors support payment software vendors across the full PCI S3 certification lifecycle:
- PCI S3 readiness and gap assessments against v2.0
- Secure architecture, design and sensitive asset reviews
- Secure software development lifecycle (SDLC) validation
- Application security testing
- PCI S3 validation and PCI SSC listing support
- v1.2.1 to v2.0 transition assessments
Insights from SISA’s payment forensic investigations shape how SISA tests, so assessments focus on how payment software is actually attacked. Start your PCI S3 gap analysis with a SISA Secure Software Assessor.
Conclusion: Preparing for PCI S3 v2.0
PCI S3 certification gives payment software vendors independent proof that their products protect payment data. With v2.0 expanding scope to SDKs and requiring source code access, an SBOM and sensitive asset documentation, vendors should start preparing now. A gap assessment is the fastest way to see where your software stands and plan a smooth path to validation.
FAQs
1. What is PCI S3 certification?
PCI S3 certification is the validation of payment software against the PCI Secure Software Standard. A PCI SSC-qualified assessor evaluates the software, and accepted products are listed on the PCI SSC website.
2. Is PCI S3 certification mandatory?
The PCI SSC does not enforce it. However, payment brands, acquirers and enterprise customers often require validated software, making it a commercial necessity for many vendors.
3. What is the difference between PCI S3 and PCI DSS?
PCI S3 validates the security of a software product. PCI DSS applies to organizations that store, process or transmit cardholder data. Merchants using PCI S3-validated software still need PCI DSS compliance.
4. How long does PCI S3 certification take?
It depends on the software’s complexity, documentation and remediation needs. Vendors with a documented architecture, an SBOM and mature secure development practices typically move faster. A gap assessment provides a reliable estimate.
5. Are PCI S3 v1.2.1 validations still valid?
Yes. Existing v1.2.1 listings remain valid until further notice. A 12-month transition to v2.0 begins once v2.0 assessor training is available.