PCI DSS v4.0/Requirement 06: Develop and Maintain Secure Systems and Software/87 of 250
6.3.2Security vulnerabilities are identified and addressed
Control family: Requirement 06: Develop and Maintain Secure Systems and Software
Control description
Defined Approach Requirements:
An inventory of bespoke and custom software, and third-party software components incorporated into bespoke and custom software is maintained to facilitate vulnerability and patch management.
Defined Approach Testing Procedures:
6.3.2.a Examine documentation and interview personnel to verify that an inventory of bespoke and custom software and third-party software components incorporated into bespoke and custom software is maintained, and that the inventory is used to identify and address vulnerabilities.
6.3.2.b Examine software documentation, including for bespoke and custom software that integrates third-party software components, and compare it to the inventory to verify that the inventory includes the bespoke and custom software and third-party software components.