6.4.5.3 requires what for changes?

6.4.5.3 requires what for changes?

• A. Decommissioning old systems
• B. User acceptance testing only
• C. Functionality testing to verify that the change does not adversely impact the security of the system.
• D. No testing

Answer: (C)

When changes are made to systems that handle cardholder data, you must verify that those changes do not weaken security. The requirement is to perform functionality testing that specifically checks the security impact of the change, ensuring that existing protections continue to work and no new vulnerabilities are introduced. This goes beyond just making sure the change works from a user or business perspective; it focuses on preserving the system’s security posture after the modification. Decommissioning old systems isn’t about validating the security impact of a change. Relying only on user acceptance testing addresses usability, not security. And skipping testing leaves critical risk unaddressed. By doing thorough functionality testing to confirm security remains intact, you ensure the change aligns with PCI DSS requirements and keeps card data protected.

When changes are made to systems that handle cardholder data, you must verify that those changes do not weaken security. The requirement is to perform functionality testing that specifically checks the security impact of the change, ensuring that existing protections continue to work and no new vulnerabilities are introduced. This goes beyond just making sure the change works from a user or business perspective; it focuses on preserving the system’s security posture after the modification.

Decommissioning old systems isn’t about validating the security impact of a change. Relying only on user acceptance testing addresses usability, not security. And skipping testing leaves critical risk unaddressed. By doing thorough functionality testing to confirm security remains intact, you ensure the change aligns with PCI DSS requirements and keeps card data protected.