WIXLIB

3 Roles and ResponsibilitiesThere are several stakeholders involved in the Secure SLC Program. The following sections definetheir respective roles and responsibilities in connection with Program participation.3.1 VendorsVendors are responsible for:Selecting a Secure SLC Assessor Company to perform the initial Assessment and requalification Assessments every three years of the Vendor’s secure software lifecyclemanagement (“Secure SLC”) processes against the PCI Secure SLC Standard;Ensuring policies and processes that govern how the Vendor manages and supports its SecureSLC processes for software are in place and followed consistently;Ensuring all tools, technologies, and techniques used to support and manage the Secure SLCare properly managed to ensure continued effectiveness;Managing personnel involved in the design and development of the software throughout itslifecycle, including applicable Vendor personnel and third-party contributors;Complying with the Vendor Release Agreement (VRA), including the adoption andimplementation of Vulnerability Handling Policies consistent with industry best practices;Submitting their Secure SLC methodology, policies, procedures and supporting documentationto the Secure SLC Assessor Company for review. Per the VRA, Vendors authorize the SecureSLC Assessor Company to submit resulting reports and related information to PCI SSC;Paying all invoices from PCI SSC in a timely fashion;Maintaining an internal quality assurance process for their self-testing and attestation efforts;andStaying up to date with PCI Secure SLC Standard, Secure SLC Program documents,statements and guidance on the Website, as well as industry trends and best practices.3.2 PCI Security Standards CouncilPCI SSC is the standards body that maintains the PCI SSC Standards. In relation to the Secure SLCProgram, PCI SSC is responsible for:Maintaining the list of Secure SLC Qualified Vendors on the Website;Maintaining the lists of Secure SLC Assessor Companies and Secure SLC Assessors on theWebsite;Providing training for and qualifying Secure SLC Assessor Companies and Secure SLCAssessors to perform Secure SLC Assessments;Maintaining and updating the PCI Secure SLC Standard and related documentation accordingto a standards lifecycle management process; andReviewing all submissions to be provided to PCI SSC as part of the Program, such as Vendorapplications, qualification and re-assessment materials, Reports on Compliance (ROCs) andrelated change submissions for compliance with baseline quality standards, including but notlimited to confirming:–Submissions are correct as to form;PCI Software Security Framework – Secure Software Lifecycle Program Guide, v1.1 2019-2021 PCI Security Standards Council, LLC. All rights reserved.February 2021Page 6

–Secure SLC Assessor Companies properly determine whether Vendors are eligible forqualification under the Secure SLC Program (PCI SSC reserves the right to remove fromthe list of Secure SLC Qualified Vendors on the Website any Secure SLC Qualified Vendoror reject any candidate Secure SLC Qualified Vendor determined to be ineligible for theProgram);–Secure SLC Assessor Companies adequately report Secure SLC compliance of Vendorsin their associated submissions; and–Detail provided in the submissions meets PCI SSC reporting requirements.As part of the quality assurance (“QA”) process for the Program, Secure SLC Assessor Companiesmust demonstrate to PCI SSC that they meet PCI SSC‘s QA and Program qualification requirements;and PCI SSC assesses whether Secure SLC Assessor Company operations appear to meet PCISSC's QA and Program qualification requirements on an ongoing basis.Note: PCI SSC does not perform Assessments of or validate Vendors. Assessment and validation isthe role of the Secure SLC Assessor Company and its Secure SLC Assessors. Vendor listing on theList of Secure SLC Qualified Vendors signifies that the applicable Secure SLC Assessor Companyhas determined that the Vendor complies with the PCI Secure SLC Standard, that the Secure SLCAssessor Company has submitted a corresponding ROC to PCI SSC, and that PCI SSC hasdetermined that such ROC has satisfied all PCI SSC documentation requirements as of the time ofPCI SSC's review.3.3 Secure SLC Assessor CompaniesSecure SLC Assessor Companies (with at least one full-time, qualified Secure SLC Assessor at alltimes) are qualified by PCI SSC to perform Secure SLCNote: Subject to satisfactionAssessments, subject to continued compliance with Programof all applicablerequirements. Secure SLC Assessor Companies are responsible for:requirements, a SSFAssessor Company mayEnsuring that the Secure SLC Assessor Company and itsparticipate in one or moreSecure SLC Assessors remain in good standing for ProgramPCI SSC programspurposes;associated with the SSF.Ensuring that its Secure SLC Assessors each complete allThe PCI SSC programs forwhich a SSF Assessorrequired Secure SLC Assessor training:Company is a qualified byPerforming Secure SLC Assessments in accordance with thePCI SSC are specified in thePCI Secure SLC Standard, this Program Guide, the SSFSSF Assessor Companylisting on the Website.Qualification Requirements and the SSF Agreement;Providing an opinion regarding whether the Secure SLCAssessor Company’s Vendor customer meets the intent and requirements of the PCI SecureSLC Standard;Documenting each Secure SLC Assessment in a ROC and accompanying Attestation ofCompliance (“AOC”) using the Secure SLC ROC Report and AOC Templates;Providing documentation within each ROC and accompanying AOC to demonstrate theVendor’s compliance with the PCI Secure SLC Standard;Submitting each ROC to PCI SSC, along with the VRA, if applicable, each signed by bothSecure SLC Assessor Company and Vendor;Maintaining an internal quality assurance process for their Secure SLC Assessment efforts;PCI Software Security Framework – Secure Software Lifecycle Program Guide, v1.1 2019-2021 PCI Security Standards Council, LLC. All rights reserved.February 2021Page 7

Staying up to date with PCI SSC statements and guidance, industry trends, and best practices;andSatisfying all applicable SSF and Program requirements at all times, including but not limited tosuccessful completion of annual requalification and adhering to the applicable SSFQualification Requirements.It is the Secure SLC Assessor Company’s responsibility to assess a Vendor’s Secure SLC processesfor compliance with the PCI Secure SLC Standard and document its findings and opinions in theapplicable ROC using the applicable ROC report template. PCI SSC does not approve ROCs from atechnical perspective; it performs quality assurance reviews to confirm that the ROC adequatelydocuments the Assessor’s validation and attestation of compliance.3.4 Third-Party Service ProvidersA Vendor’s Secure SLC process may require or utilize one or more products or services provided bythird-parties (e.g., unrelated companies that perform software development services, code reviews,testing of software, and/or other services). Such third-parties are considered “Third-Party ServiceProviders” with respect to the Vendor’s Secure SLC processes, and their products and services, tothe extent required, utilized, or incorporated for, into or as part of the Vendor’s Secure SLCprocesses, are evaluated/assessed as part of Vendor’s Secure SLC Assessment. If eligible, a ThirdParty Service Provider may choose to undergo its own Secure SLC Assessment for its ownapplicable product(s) or service(s).Note: For a given Secure SLC Assessment, the supporting Third-Party Service Provider product(s) orservice(s) are considered part of the Vendor’s overall Secure SLC processes, areevaluated/assessed as part of the Vendor’s entire secure software lifecycle process Assessment andare not eligible for separate listing as part of the Secure SLC Program.PCI Software Security Framework – Secure Software Lifecycle Program Guide, v1.1 2019-2021 PCI Security Standards Council, LLC. All rights reserved.February 2021Page 8

4 Preparation for Assessment4.1 Recommended Activities Prior to the ReviewPrior to commencing a Secure SLC Assessment with a Secure SLC Assessor Company, Vendors areencouraged to take the following preparatory actions:Review the PCI Secure SLC Standard and related documentation located on the Website;Determine/assess readiness to comply with the PCI Secure SLC Standard:–Perform a gap analysis between the Secure SLC methods, policies, procedures, practices,etc. to be assessed and the requirements of the PCI Secure SLC Standard;–Correct any gaps; and–If desired, the Vendor can engage the Secure SLC Assessor Company to perform a preassessment or gap analysis of the Vendor’s software lifecycle practices. If the Assessornotes deficiencies that would prevent a compliant result, the Assessor may provide thecandidate with a list of items to be addressed before the formal Assessment begins.4.2 Required Documentation and MaterialsAll PCI SSC published information relevant to the PCI Secure SLC Standard and Program isavailable on the Website.In connection with each Assessment, the Vendor must provide the applicable supportingdocumentation to the Secure SLC Assessor Company. Examples of documentation and other itemsthe Vendor should be prepared to submit to the Secure SLC Assessor Company include, but are notlimited to:Note: The Secure SLCDocumentation including policies and processes, internalAssessor Company maystandards, requirement mappings, internal presentations, trainingrequest additional materialmaterials, or any other documentation or records that clearly andas necessary (no Vendorconsistently illustrate that the Vendor has made reasonable effortsdocumentation supportingthe assessment is sentto understand and monitor its external security and compliancedirectly to PCI SSC).requirements;Software-specific documentation, features lists, software-specificsecurity control inventories, change-management documentation, risk assessment reports,penetration test results, output from active monitoring systems, bug bounty program data, orany other evidence or information that clearly and consistently illustrates that the effectivenessof software security controls is monitored and that software-specific software security controlsare updated, augmented, or replaced when no longer effective at satisfying their intendedpurpose of resisting attacks;Documentation supporting software communications such as release notes to communicate allsoftware changes to stakeholders upon software updates, publicly available information ornotifications regarding the software updates, and change summary information for softwareupdates;Additional documentation—such as diagrams and flowcharts—that will aid in the Secure SLCreview; andPCI Software Security Framework – Secure Software Lifecycle Program Guide, v1.1 2019-2021 PCI Security Standards Council, LLC. All rights reserved.February 2021Page 9

The Vendor‘s executed VRA (if PCI SSC does not already have a copy of the then most currentversion of the VRA signed by the Vendor).4.3 Secure SLC Assessment TimeframesThe amount of time necessary for a Secure SLC Assessment, from the start of an Assessment tolisting on the Website, can vary widely depending on factors such as:Whether the Vendor’s Secure SLC processes and procedures meet all requirements of the PCISecure SLC Standard at the start of the Assessment–Corrections to the Vendor’s Secure SLC processes to achieve compliance will delayvalidation.Prompt payment of the fee due to PCI SSC–PCI SSC will not commence review of the ROC until the applicable fee has been paid.Quality of the Secure SLC Assessor Company's submission to PCI SSC–Incomplete submissions or those containing errors, for example, missing or unsigneddocuments, incomplete, inconsistent, or insufficient submissions, will result in delays in thereview process.–If the quality of the submission results in PCI SSC reviewing the ROC more than once,providing comments back to the Secure SLC Assessor Company to address each time,this will increase the length of time for the review process.Any Assessment timeframes provided by a Secure SLC Assessor Company should be consideredestimates. Problems found during the review or acceptance process, discussions required betweenthe Secure SLC Assessor, the Vendor, and/or PCI SSC, or other matters may significantly impactreview times and cause delays and/or cause the review to end prematurely.4.4 Vendor Release Agreement (VRA)The Vendor's signed copy of the then most current version of the Vendor Release Agreement(available on the Website) must be provided to the Secure SLC Assessor Company at the beginningof each Secure SLC Assessment. The Secure SLC Assessor Company provides the VRA to PCISSC with the ROC and AOC submitted for that Assessment. Among other things, the VRA coversconfidentiality issues, the Vendor's agreement to adhere to Secure SLC Program requirements,policies and procedures, and gives permission to the Vendor’s Secure SLC Assessor Company torelease ROCs and related materials to PCI SSC for review. The VRA also requires Vendors to adoptand comply with industry standard Vulnerability Handling Policies.Note: A ROC will not be reviewed by PCI SSC without the then most current VRA on file from therelevant Vendor. However, so long as the executed current VRA is on file with PCI SSC for therelevant Vendor, it is not required to re-submit the same VRA with each subsequent ROC for thesame Vendor.PCI Software Security Framework – Secure Software Lifecycle Program Guide, v1.1 2019-2021 PCI Security Standards Council, LLC. All rights reserved.February 2021Page 10

4.5 Secure SLC Assessment Related Fees4.5.1 Secure SLC Assessor Company FeesThe prices and fees charged by Secure SLC Assessor Companies are not set by PCI SSC.These fees are negotiated between the Secure SLC Assessor Company and its customers (i.e.,Vendors seeking Secure SLC assessments to become Secure SLC Qualified Vendors). Beforedeciding on a Secure SLC Assessor Company, it is recommended that the Vendor check thelist of Secure SLC Assessor Companies on the Website, talk to several Secure SLC AssessorCompanies and follow its own vendor-selection processes.4.5.2 Secure SLC Qualified Vendor Listing FeeVendors are required to pay a Secure SLC Qualified VendorListing Fee to PCI SSC. The New Secure SLC Qualified VendorListing Fee will be invoiced and must be received by PCI SSCbefore the applicable Secure SLC Assessment ROCsubmission will be reviewed, accepted and added to the List ofSecure SLC Qualified Vendors by PCI SSC. Upon Acceptanceof the Secure SLC Assessment ROC submission by PCI SSC,PCI SSC will sign and return a copy of the Attestation ofCompliance to both the Vendor and the Secure SLC AssessorCompany.Program fees are non-refundable and are subject to changeupon posting of revised fees on the Website.PCI Software Security Framework – Secure Software Lifecycle Program Guide, v1.1 2019-2021 PCI Security Standards Council, LLC. All rights reserved.Note: The Vendor pays allSecure SLC Assessmentrelated fees directly to theSecure SLC AssessorCompany (these fees arenegotiated between theVendor and the Secure SLCAssessor Company).PCI SSC will bill the Vendorfor the New Secure SLCVendor Listing Fee theVendor pays this fee directlyto PCI SSC.February 2021Page 11

5 Secure SLC Assessment and Listing

3.4 Third-Party Service Providers A Vendor's Secure SLC process may require or utilize one or more products or services provided by third-parties (e.g., unrelated companies that perform software development services, code reviews, testing of software, and/or other services). Such third-parties are considered "Third-Party Service