6.5 Changes to all system components are managed securely
How to meet it
Apply change control with documentation, testing, approval and rollback.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 6.5, in plain English.
6.5.1Changes to production components follow procedures capturing reason, security impact, approval, testing, and rollback.
6.5.2After a significant change, all applicable PCI DSS requirements are confirmed in place on affected systems and documentation updated.
6.5.3Pre-production environments are kept separate from production, enforced by access controls.
6.5.4Roles and functions are separated between production and pre-production for accountability.
6.5.5Live PANs are not used in pre-production unless that environment is in the CDE and fully protected.
6.5.6Test data and test accounts are removed before a system moves into production.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Information security roles and responsibilitiesUse for ISO 27001 A.5.2, A.5.3 and A.5.4, defining security roles, segregation of duties, management responsibilities, and SOC 2 organisational controls.
Open the control-to-policy mapBack to Requirement 6, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.