Every business day I have multiple conversations with software vendors regarding PA-DSS. Some of these vendors are currently being pressured by important clients to address PA-DSS validation. Some are looking at their strategic product investments over the next 18 months including technology, features enhancements, marketing, etc. and are building PA-DSS into their operational model. These two groups are actively moving forward with the PA-DSS validation process. NetSPI is helping them with potential changes to process, documentation, and (if needed) code to make certain that their applications are going to successfully move through the validation process.

However, other vendors are taking a bit of a different approach – they have been made aware of the standard and that it ‘might apply’ and are doing some preliminary research on what they actually need to worry about. Often they are looking for an ‘out’ - a way to claim that PA-DSS doesn’t apply to them (typically because they aren’t a ‘classic’ POS software provider) or they are looking for reassurance that VISA and the PCI council aren’t really going to enforce the standard.

The difficulty for this last group of software providers is that the definition of what falls under PA-DSS is pretty straightforward and the council and VISA have given every indication that they are going to enforce the standard (see my other post here). Also, since a majority of the leading POS vendors are aggressively addressing PA-DSS, the council isn’t going to really feel all that much pressure to back-off in July.

Why am I bringing this up again? Because we are getting closer and closer to the July 2010 deadline and there are still a LOT of software vendors that are continuing to drag their feet. Please keep in mind that there aren’t all that many PA-QSAs (particularly ones that have experience and a proven track record) and validation is not a going to happen in a week.

My guess, based on what I’m seeing in the market, is that there will be a sizable wave of companies in the spring that finally realize/accept that they have to do something and there will suddenly be a mad rush to get validated – causing a tremendous backlog and very long lead times. My suggestion is to not get caught up in that wave or you might get stuck in a bad spot come July – get things moving now …