6.5.3Changes to all system components are managed securely

Defined Approach Requirements:

Pre-production environments are separated from production environments and the separation is enforced with access controls.

Defined Approach Testing Procedures:

6.5.3.a Examine policies and procedures to verify that processes are defined for separating the pre?production environment from the production environment via access controls that enforce the separation.

6.5.3.b Examine network documentation and configurations of network security controls to verify that the pre-production environment is separate from the production environment(s).

6.5.3.c Examine access control settings to verify that access controls are in place to enforce separation between the pre-production and production environment(s)