Framework Information Security & Privacy
PA-P2PE refers to the application component of the PCI P2PE program: the software that runs on a PTS-approved point-of-interaction device and handles account data before encryption.
Under the P2PE standard, such applications are assessed against Domain 2 (application security) and can be validated and listed separately as P2PE Applications so that multiple solution providers can reuse them.
Validation confirms the application does not store or expose clear-text account data, follows secure development and change control, and is deployed only on approved devices.
An application vendor must keep in writing a secure software development lifecycle, code review and testing records, a description of every function that touches account data, release and versioning procedures, an implementation guide for solution providers, and the P2PE application assessment report and attestation.
Listing is maintained through annual attestations and reassessment when the application or the standard version changes. Verify the exact standard version and program terms in the PCI SSC P2PE Program Guide, since the Council folds application validation into the P2PE standard rather than publishing a standalone PA-P2PE document.
Voluntary for payment application vendors, but required if they want the application listed as a P2PE Application for use in listed P2PE solutions. Solution providers that use unlisted applications must have them assessed within their own solution validation.
Application architecture and data flow; secure development lifecycle documentation; code review and vulnerability testing records; cryptographic usage and key handling design; change control and versioning records; implementation guide; list of supported PTS devices; prior application assessment report and attestation.
Assessors
A PCI SSC qualified P2PE Application Assessor company, which is a P2PE Assessor company additionally qualified to validate applications on behalf of vendors. Accredited by PCI Security Standards Council qualification.
Public register of assessors: https://www.pcisecuritystandards.org/assessors_and_solutions/point_to_point_encryption_assessors/
No firm has claimed a PCI PA-P2PE assessor listing yet. Claim yours →
Consultants
A small set of P2PE assessor companies offer application readiness reviews, secure development lifecycle consulting and code review. Engagements are shorter than full solution validations.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
Software
Tools that name this framework in their own material.
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.