Your payment stack runs on open source. PCI DSS 4.0 requires SBOM evidence for every component of it.
Black Duck finds every component. Polarion governs the response. X-DLM™ produces the PCI DSS and DORA evidence chain before any QSA or regulator asks.
and
92% of FinTech codebases contain high or critical open-source vulnerabilities. PCI DSS Requirement 6.3.2 requires an SBOM for every one of them.
Of Financial Services and FinTech codebases contain at least one high or critical open-source vulnerability per OSSRA 2026. Every one is a potential PCI DSS finding or DORA ICT risk event.
PCI DSS 4.0 Requirement 6.3.2 mandates a documented inventory of open-source software in payment applications — maintained and reviewed at least annually. Black Duck produces it continuously.
Black Duck BDSA advisories surface critical vulnerabilities up to 3 weeks ahead of NVD — covering payment cryptographic libraries, API frameworks, and financial middleware CVEs that general databases miss.
Known vulnerabilities in the Black Duck KnowledgeBase — including 63K+ exclusive BDSA advisories with exploit evidence and direct remediation guidance not available in NVD or OSS communities.
Sources: OSSRA 2026. PCI DSS v4.0 Requirement 6.3.2. Black Duck KnowledgeBase.
The gap is not development quality. It is the governed evidence chain PCI DSS QSAs and DORA supervisors require.
- 01
PCI DSS 4.0 Req. 6.3.2 SBOM — continuous, not pre-assessment
PCI DSS 4.0 Requirement 6.3.2 mandates a documented, maintained inventory of all bespoke and custom software containing open-source components in payment applications. Black Duck generates this inventory automatically from source, containers, and binaries. X-DLM™ links every SBOM component to Polarion release records and maintains the inventory continuously — so QSA assessors receive a current SBOM, not a pre-assessment reconstruction.
- 02
EU DORA Article 9 ICT third-party dependency documentation
EU DORA Article 9 requires documented ICT risk management processes including identification and management of ICT third-party dependencies — which includes open-source software used in production financial systems. X-DLM™ maps every Black Duck finding to DORA risk categories and routes remediation through Polarion governance workflows with ownership and timeline enforcement — building continuous DORA Article 9 evidence from the same engineering workflow.
- 03
Cryptographic library and API security governance before production
Payment platforms depend on OpenSSL, Bouncy Castle, libsodium, and similar cryptographic libraries where a single unpatched CVE creates a card data exposure risk and a direct PCI DSS violation. Black Duck surfaces BDSA advisories for cryptographic CVEs up to 3 weeks ahead of NVD. X-DLM™ routes each advisory into Polarion with PCI DSS practice mapping and escalation timelines — before the vulnerability reaches production.
- 04
FAPI 2.0 and Open Banking dependency governance
FAPI 2.0 compliance for open banking APIs requires demonstrably secure implementation of OAuth 2.0, PKCE, and financial-grade API security specifications. Black Duck identifies open-source OAuth libraries, JWT implementations, and API gateway dependencies with known vulnerabilities or compliance-relevant version issues. X-DLM™ governs remediation in Polarion with traceability to FAPI 2.0 specification requirements.
See how Siemens Polarion and Black Duck become one governed software risk workflow.
X-DLM™ turns Black Duck software supply chain intelligence into Siemens Polarion work items, requirements links, approvals, escalation paths, and continuously maintained evidence.
Brand authority buyers recognize
Backed by Siemens lifecycle governance and Black Duck AppSec intelligence.
Siemens Polarion ALM
Polarion provides the lifecycle system of record for requirements, tests, approvals, traceability, workflow automation, audit evidence, and regulated software delivery.
Black Duck Software Composition Analysis
Black Duck identifies open source and third-party components across source, binaries, containers, firmware, snippets, AI-generated code, and C/C++ environments without package managers.
Medical device companies answer to more than one framework — simultaneously.
FDA Section 524B is the floor, not the ceiling. IEC 62304, EU MDR, ISO 14971, HIPAA, and NIST SSDF run in parallel — each with its own evidence requirements, its own submission deadline, and its own consequence for missing components.
View FDA 524B, IEC 62304 & All Regulations →Turn software risk evidence into FinTech trust.
Download the brochure or book a discovery call to see how X-DLM™ connects Siemens Polarion and Black Duck for governed software supply chain evidence.