PCI DSS v4.0/Requirement 06: Develop and Maintain Secure Systems and Software/82 of 250
6.2.2Bespoke and custom software are developed securely
Control family: Requirement 06: Develop and Maintain Secure Systems and Software
Control description
Defined Approach Requirements:
Software development personnel working on bespoke and custom software are trained at least once every 12 months as follows:
- On software security relevant to their job function and development languages.
- Including secure software design and secure coding techniques.
- Including, if security testing tools are used, how to use the tools for detecting vulnerabilities in software.
Defined Approach Testing Procedures:
6.2.2.a Examine software development procedures to verify that processes are defined for training of software development personnel developing bespoke and custom software that includes all elements specified in this requirement.
6.2.2.b Examine training records and interview personnel to verify that software development personnel working on bespoke and custom software received software security training that is relevant to their job function and development languages in accordance with all elements specified in this requirement