PCI SSCPCI DSSSecurity PolicyEASYFree question
What does PCI DSS require for change management?
- A.Changes can be made without documentation
- B.Only IT management needs to approve changes, because test data drawn from production is acceptable in development so long as the developers sign confidentiality agreements
- C.A formal change management process must be followed for all changes to CDE systems
- D.Change management is only for major changes, since v4.0 exempts bespoke and custom-built software from its secure development requirements
Why C is correct
PCI DSS requires formal change management including documentation, testing, approval, and rollback procedures for all changes to CDE systems.
Know someone studying for PCI DSS? Send them this one.