6.5.6Changes to all system components are managed securely

Defined Approach Requirements:

Test data and test accounts are removed from system components before the system goes into production.

Defined Approach Testing Procedures:

6.5.6.a Examine policies and procedures to verify that processes are defined for removal of test data and test accounts from system components before the system goes into production.

6.5.6.b Observe testing processes for both off-the shelf software and in-house applications, and interview personnel to verify test data and test accounts are removed before a system goes into production.

6.5.6.c Examine data and accounts for recently installed or updated off-the-shelf software and in-house applications to verify there is no test data or test accounts on systems in production