6.2 Bespoke and custom software is developed securely
How to meet it
Train developers, use a secure SDLC, and review code before release.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 6.2, in plain English.
6.2.1Bespoke and custom software is built securely, following industry secure-development standards and weighing security at every lifecycle phase.
6.2.2Developers are trained at least every 12 months on software security relevant to their role and on secure design and coding.
6.2.3Bespoke and custom software is reviewed before release to find and fix coding vulnerabilities.
6.2.3.1Manual code reviews are done by someone other than the author, who knows secure coding, with management approval before release.
6.2.4Techniques are used to prevent or reduce common software attacks such as injection, cryptography misuse, and access-control flaws.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.Secure development policyUse for ISO 27001 A.8.25 to A.8.32, source code controls, change management, and SOC 2 change controls.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Cryptography and key management policyUse for ISO 27001 A.8.24, secure authentication, encryption, SOC 2 Security, and PCI DSS encryption requirements.
Open the control-to-policy map← 6.1 Processes and mechanisms are defined and understood6.3 Security vulnerabilities are identified and addressed →
Back to Requirement 6, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.