Request for Comments: Secure Software Lifecycle (Secure SLC) Standard v2.0

From 19 December to 29 January, eligible PCI SSC stakeholders are invited to review and provide feedback on the draft Secure Software Lifecycle (Secure SLC) Standard v2.0 during a 40-day request for comments (RFC) period.

The RFC will be available through the PCI SSC portal, including instructions on how to access the documents and submit feedback. Eligible stakeholders will also receive instructions via email. As a reminder, participants are required to accept a Non-Disclosure Agreement (NDA) to download the document. Please review the RFC Process Guide for more information.    

Please note that PCI SSC can only accept comments that are submitted via the PCI SSC portal and received within the defined RFC period.    

Background on the Secure Software Lifecycle (Secure SLC) Standard

The PCI Secure Software Lifecycle (Secure SLC) Standard and its supporting materials are currently undergoing a major revision. The PCI Secure SLC Standard is one of two standards that are part of the PCI Software Security Framework (SSF). It provides security requirements and assessment procedures for software vendors to integrate into their software development lifecycles and to validate that secure lifecycle management practices are in place. Feedback received during this RFC period will be reviewed and considered for inclusion in the final updates to the draft standard before its publication in Q3 2025. PCI SSC will also hold an RFC period on the draft Secure Software Standard v2.0 in Q1 2025.