PCI DSS v4.0/Requirement 06: Develop and Maintain Secure Systems and Software/84 of 250
6.2.3.1Bespoke and custom software are developed securely
Control family: Requirement 06: Develop and Maintain Secure Systems and Software
Control description
Defined Approach Requirements:
If manual code reviews are performed for bespoke and custom software prior to release to production, code changes are:
- Reviewed by individuals other than the originating code author, and who are knowledgeable about code-review techniques and secure coding practices.
- Reviewed and approved by management prior to release.
Defined Approach Testing Procedures:
6.2.3.1.a If manual code reviews are performed for bespoke and custom software prior to release to production, examine documented software development procedures and interview responsible personnel to verify that processes are defined for manual code reviews to be conducted in accordance with all elements specified in this requirement.
6.2.3.1.b Examine evidence of changes to bespoke and custom software and interview personnel to verify that manual code reviews were conducted in accordance with all elements specified in this requirement