Are development/test environments separate from the 6.4.1 Review change control production environment? processes and procedures Examine network documentation and network device configurations Is access control in place to enforce the separation Review change control between the development/test environments and the processes and procedures production environment? Examine access control settings 6.4.2 Is separation of duties between personnel assigned to Review change control the development/test environments and those assigned to processes and procedures the production environment? Observe processes Interview personnel 6.4.3 Are production data (live PANs) not used for testing or Review change control development? processes and procedures Observe processes Interview personnel Examine test data 6.4.4 Are test data and accounts removed from system Review change control components before the system becomes active / goes into processes and procedures production? Observe processes Interview personnel Examine production systems
6.4.1 Are development/test environments separate from the production environment? Review change control processes and procedures Examine network documentation and network device configurations Is access control in place to enforce the separation between the development/test environments and the production environment? Review change control processes and procedures Examine access control settings 6.4.2 Is separation of duties between personnel assigned to the development/test environments and those assigned to the production environment? Review change control processes and procedures Observe processes Interview personnel 6.4.3 Are production data (live PANs) not used for testing or development? Review change control processes and procedures Observe processes Interview personnel Examine test data 6.4.4 Are test data and accounts removed from system components before the system becomes active / goes into production? Review change control processes and procedures Observe processes Interview personnel Examine production systems
PCI-DSS-v3_2-SAQ-D_Merchant-rev1_1.docx