PCI SSF

Secure Software Standard: core requirements (Control Objectives 1 to 12) – PCI SSF

PCI SSF 4.1: Secure Software Standard 4.1 (Critical Asset Protection)

The vendor identifies which attack scenarios apply to the software; this extends the threat identification in Control Objective 10.1 and is validated at the same time.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Secure Software Standard: core requirements (Control Objectives 1 to 12) – PCI SSF

1.1 Secure Software Standard 1.1 (Critical Asset Identification)
1.2 Secure Software Standard 1.2 (Critical Asset Identification)
1.3 Secure Software Standard 1.3 (Critical Asset Identification)
10.1 Secure Software Standard 10.1 (Threat and Vulnerability Management)
10.2 Secure Software Standard 10.2 (Threat and Vulnerability Management)
11.1 Secure Software Standard 11.1 (Secure Software Updates)
11.2 Secure Software Standard 11.2 (Secure Software Updates)
12.1 Secure Software Standard 12.1 (Software Vendor Implementation Guidance)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All PCI SSF controls