6.4.5.1 Documentation of impact? Trace changes to change control documentation Examine change control documentation 6.4.5.2 Documented approval by authorized parties? Trace changes to change control documentation Examine change control documentation Functionality testing to verify that the change does 6.4.5.3 Trace changes to change control not adversely impact the security of the system? documentation Examine change control documentation For custom code changes, testing of updates for Trace changes to change control compliance with PCI DSS Requirement 6.5 before documentation being deployed into production? Examine change control documentation 6.4.5.4 Back-out procedures? Trace changes to change control documentation Examine change control documentation (c) Are applications developed based on secure 6.5 coding guidelines to protect applications from, at a minimum, the following vulnerabilities: 6.5.1 Do coding techniques address injection flaws, Examine software-development particularly SQL injection? policies and procedures Note: Also consider OS Command Injection, LDAP and Interview responsible personnel XPath injection flaws as well as other injection flaws. 6.5.2 Do coding techniques address buffer overflow Examine software-development vulnerabilities? policies and procedures Interview responsible personnel
6.4.5.1 Documentation of impact? Trace changes to change control documentation Examine change control documentation 6.4.5.2 Documented approval by authorized parties? Trace changes to change control documentation Examine change control documentation 6.4.5.3 Functionality testing to verify that the change does not adversely impact the security of the system? Trace changes to change control documentation Examine change control documentation For custom code changes, testing of updates for compliance with PCI DSS Requirement 6.5 before being deployed into production? Trace changes to change control documentation Examine change control documentation 6.4.5.4 Back-out procedures? Trace changes to change control documentation Examine change control documentation 6.5 (c) Are applications developed based on secure coding guidelines to protect applications from, at a minimum, the following vulnerabilities: 6.5.1 Do coding techniques address injection flaws, particularly SQL injection? Note: Also consider OS Command Injection, LDAP and XPath injection flaws as well as other injection flaws. Examine software-development policies and procedures Interview responsible personnel 6.5.2 Do coding techniques address buffer overflow vulnerabilities? Examine software-development policies and procedures Interview responsible personnel
SAQ_A-EP_v3.docx