6.5.4Changes to all system components are managed securely

Defined Approach Requirements:

Roles and functions are separated between production and pre-production environments to provide accountability such that only reviewed and approved changes are deployed

Defined Approach Testing Procedures:

6.5.4.a Examine policies and procedures to verify that processes are defined for separating roles and functions to provide accountability such that only reviewed and approved changes are deployed.

6.5.4.b Observe processes and interview personnel to verify implemented controls separate roles and functions and provide accountability such only reviewed and approved changes are deployed.