PCI SSCPCI DSSSecurity PoliciesEASYFree question
What does PCI DSS require for change management policies?
- A.Formal change management procedures must exist for all changes to system components, ensuring changes are tested, approved, and documented before implementation
- B.Change procedures must cover all firewall rule edits, and the QSA must approve each one before it reaches production
- C.A change policy must apply to all production servers, and testing is completed by the vendor after deployment
- D.Change management must record all changes to application code, and approvals are given verbally by the system owner
Why A is correct
Change management procedures must cover all system component changes, ensuring proper testing, approval, documentation, and rollback procedures.
Know someone studying for PCI DSS? Send them this one.