PCI DSS v4.0/Requirement 06: Develop and Maintain Secure Systems and Software/83 of 250
6.2.3Bespoke and custom software are developed securely
Control family: Requirement 06: Develop and Maintain Secure Systems and Software
Control description
Defined Approach Requirements:
Bespoke and custom software is reviewed prior to being released into production or to customers, to identify and correct potential coding vulnerabilities, as follows:
- Code reviews ensure code is developed according to secure coding guidelines.
- Code reviews look for both existing and emerging software vulnerabilities.
- Appropriate corrections are implemented prior to release.
Defined Approach Testing Procedures:
6.2.3.a Examine documented software development procedures and interview responsible personnel to verify that processes are defined that require all bespoke and custom software to be reviewed in accordance with all elements specified in this requirement.
6.2.3.b Examine evidence of changes to bespoke and custom software to verify that the code changes were reviewed in accordance with all elements specified in this requirement.