6.1 Secure development processes and roles
Requirement 6.1 asks for current policies and procedures for developing and maintaining secure systems and software, and documented roles for development, patching and change management.
Requirement 6 Secure systems and software
Requirement 6 covers secure software development, vulnerability and patch management, public-facing web application protection and change management. Each page covers one second-level requirement.
6.2 Secure bespoke and custom software development
Requirement 6.2 covers secure development of bespoke and custom software: a secure SDLC, annual developer training, code review before release, and techniques that prevent common attacks such as injection, XSS and access control bypass.
6.3 Identifying and addressing security vulnerabilities
Requirement 6.3 covers vulnerability management for all software: monitoring industry sources and risk-ranking new vulnerabilities, keeping an inventory of custom software and its components, and installing critical patches within one month.
6.4 Protecting public-facing web applications
Requirement 6.4 protects public-facing web applications: an automated solution such as a WAF in front of them, and management of every payment page script loaded in the consumer's browser to stop e-skimming.
6.5 Change management
Requirement 6.5 governs change management for all system components: documented, approved and tested changes, confirming PCI DSS controls after significant changes, separated pre-production environments, and no live PANs in testing.
