6.4.5.2 Documented approval by authorized parties? Trace changes to change control documentation Examine change control documentation 6.4.5.3 (a) Functionality testing to verify that the change does not Trace changes to change control adversely impact the security of the system? documentation Examine change control documentation (b) For custom code changes, testing of updates for Trace changes to change control compliance with PCI DSS Requirement 6.5 before documentation being deployed into production? Examine change control documentation 6.4.5.4 Back-out procedures? Trace changes to change control documentation Examine change control documentation Do software-development processes address common 6.5 Review software-development coding vulnerabilities? policies and procedures Are developers trained in secure coding techniques, Interview personnel including how to avoid common coding vulnerabilities, Examine training records and understanding how sensitive data is handled in memory?
6.4.5.2 Documented approval by authorized parties? Trace changes to change control documentation Examine change control documentation 6.4.5.3 (a) Functionality testing to verify that the change does not adversely impact the security of the system? Trace changes to change control documentation Examine change control documentation (b) For custom code changes, testing of updates for compliance with PCI DSS Requirement 6.5 before being deployed into production? Trace changes to change control documentation Examine change control documentation 6.4.5.4 Back-out procedures? Trace changes to change control documentation Examine change control documentation 6.5 Do software-development processes address common coding vulnerabilities? Review software-development policies and procedures Are developers trained in secure coding techniques, including how to avoid common coding vulnerabilities, and understanding how sensitive data is handled in memory? Interview personnel Examine training records
SAQ_D_v3_Merchant.docx