What PCI standard(s) a payment app (for Smartphones) should comply with in order to be approved by PCI SSC?

Question

We are a company developing apps for Payment Service Provider(s) and in one of our apps Card Holders should enter payment Card data (such as PAN, PIN 2, CVV, Expiration Date) to do a CNP (Card Not Present) payment transaction and PAN is stored for ease of data entry in the future use.

The main standards that we are trying to comply with are PA DSS (v3.0) as well as PCI DSS.

I want to know whether there is any other standard that we should comply with. For example, the communication between Apps and Back – End services must be secure. Is there any standard for that? Should we apply PCI P2PE to our apps?

Answer 1

Only a QSA can give you a qualified answer, but I can give you my understanding.

It seems like you need to define your scope further, do you need both PA-DSS and PCI-DSS? You'd likely only need that if you are offering a service as well as providing the software to third parties to control and use. Is that the case?

But to answer your questions, you'd likely need to comply with other security standards such as OWASP or an equivalent, and implementation standards such as TLS 1.2. The PCI standards will dictate what those standards need to be. My understanding is P2PE is for card present transactions.

Your title to this post mentions approval by the PCI SSC, but you don't require their approval, you require your clients approval only. Given your clients are payment service providers, they are probably well versed in PCI, so you can just ask them what they require from you. Remember PCI is contract based.

Otherwise, from your description you would be open to every aspect of PCI compliance which could be quite a painful process. It would be worth engaging a QSA to help you define your scope, if you have not done so already, so you're not pursuing standards you may not need.

Good luck!