PCI SSC Releases Version 2.0 of the Secure Software Lifecycle Standard

What happened

The PCI Security Standards Council released version 2.0 of the Secure Software Lifecycle Standard, aligning it with the updated Secure Software Standard. The new version introduces requirements for AI use and a Sensitive Asset Identification Document. Training for assessors will be offered in Q4 2026, and organisations have a 12‑month window to move from v1.1 to v2.0. Vendors with validated Secure SLCs gain program benefits for their listed Secure Software Products.

Why it matters

Software vendors must assess the new AI and sensitive‑asset clauses and plan a migration to v2.0 within a year, or risk losing PCI program benefits.

Business impact

Failure to transition could limit eligibility for PCI program advantages, affecting market competitiveness and potentially increasing audit costs.

Checklist

• Review v2.0 requirementsHigh priority

  Compare current Secure SLC practices against the new AI and sensitive‑asset provisions.

• Plan transition timelineHigh priority

  Schedule updates to meet the 12‑month migration deadline from v1.1 to v2.0.

• Enroll in trainingMedium priority

  Register for the Q4 2026 computer‑based or instructor‑led training for Secure Software Lifecycle Assessors.

• Update documentationMedium priority

  Incorporate the Sensitive Asset Identification Document into your development lifecycle.

Who reported it

Discussion