Maturity Model for PCI SLC Compliance for Peruvian Software Development Companies based on CMMI

In the banking sector, the demand for digital payments has grown by 150% in the last three years, exposing sensitive data to risks such as theft and impersonation. To mitigate these risks, banks seek to improve their infrastructure and applications, but the IT industry in Peru has decreased by 3% annually due to incidents with products that do not meet international standards, weakening customer confidence. Therefore, a maturity model is proposed to verify compliance with Payment Card Industry Secure Software Lifecycle (PCI SLC) regulations in Peruvian companies that develop software. The model consists of 3 stages: (1) analysis, (2) design and (3) validation. In (1), information security standards and methodologies for the development of the proposal are evaluated. In (2), the model was designed under the six phases of the "De Bruin" methodology. In (3), the model was validated through a survey with experts and a case study, to know the effectiveness of the maturity model when evaluating security controls in a software. After having deployed the maturity model proposed in the case study, it was found to be at a "defined" maturity level, since it obtained a maturity score of 0.68. This result was corroborated by the case study through the detailed analysis of the maturity scores obtained for each phase of the software life cycle.