What does PCI DSS require for changes to system components?

• A.All changes must be approved by the QSA before release, with testing waived for security patches and rollback plans kept by the vendor
• B.All changes must be logged in the file integrity monitoring tool, with approval granted afterward and testing limited to production systems
• C.All changes must be submitted to the acquirer for approval, with documentation retained by the assessor and rollback plans waived for emergency fixes
• D.All changes must follow a defined change control process including documentation, approval, testing, and rollback procedures