PCI SSF

Secure Software Standard: core requirements (Control Objectives 1 to 12) – PCI SSF

PCI SSF 2.1: Secure Software Standard 2.1 (Secure Defaults)

A function the software exposes, such as an API or interface available at installation, initialisation or first use, is switched on by default only if the software architecture documents it and justifies it.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Secure Software Standard: core requirements (Control Objectives 1 to 12) – PCI SSF

1.1 Secure Software Standard 1.1 (Critical Asset Identification)
1.2 Secure Software Standard 1.2 (Critical Asset Identification)
1.3 Secure Software Standard 1.3 (Critical Asset Identification)
10.1 Secure Software Standard 10.1 (Threat and Vulnerability Management)
10.2 Secure Software Standard 10.2 (Threat and Vulnerability Management)
11.1 Secure Software Standard 11.1 (Secure Software Updates)
11.2 Secure Software Standard 11.2 (Secure Software Updates)
12.1 Secure Software Standard 12.1 (Software Vendor Implementation Guidance)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All PCI SSF controls