Time-Line

[pschranz]

Hello,

When are Service Providers required to use certified PA-DSS applications?

or

What is the time-line for PA-DSS OEMs to certify their applications?

Thanks,
Paul

[jbhall56]

The only good date announced thus far is that the PA-DSS will be released for comment in October 2007 with a final release late in fourth quarter 2007, likely the end of December.

Actual implementation of the PA-DSS will be based on when it is released and the ability of the certified application assessors to begin the assessment certification process. So, I would say that it will be mid-2008 at the earliest before you have your first PA-DSS compliant application.

Prior to that, the PABP standard will still be in effect as the PA-DSS is a phased in standard and they will co-exist for a period of time.

[wconway]

Check out Visa's latest announcement on PABP mandates. It's on Braintree's blog: http://www.braintreepaymentsolutions.com/blog/visa-mandates-that-merchants-eliminate-the-use-of-vulnerable-payment-applications/#comment-183.

This also seems to get at the question of when the brands (or at least, Visa) will mandate PA DSS.

[mdahn]

Also, check out our post:
http://pcianswers.com/2007/10/30/visa-payment-application-mandates-and-deadlines/