Which practice describes Requirement 6.4.2 in PCI DSS?

Which practice describes Requirement 6.4.2 in PCI DSS?

• A. Regular backups of production data
• B. Separation of duties between development/test and production environments
• C. Encryption of PANs in storage
• D. Periodical vulnerability scans

Answer: (B)

Separating the duties of those who develop and test software from those who run the production environment reduces the risk that a change can be introduced or deployed without proper oversight. When development, testing, and production are in distinct environments with separate access rights, changes must go through formal change-control processes, get reviewed and approved, and be deployed only by individuals with production access after appropriate testing. This makes it harder for a single person to introduce unvetted or malicious changes into live systems and helps prevent both intentional misuse and accidental errors from reaching production. Other controls address different needs. Regular backups protect data recovery, encryption of PANs safeguards data at rest, and periodic vulnerability scans detect weaknesses. But they don’t ensure that developers and production operators operate in separate spaces with controlled handoffs and approvals, which is what this requirement is focused on.

Separating the duties of those who develop and test software from those who run the production environment reduces the risk that a change can be introduced or deployed without proper oversight. When development, testing, and production are in distinct environments with separate access rights, changes must go through formal change-control processes, get reviewed and approved, and be deployed only by individuals with production access after appropriate testing. This makes it harder for a single person to introduce unvetted or malicious changes into live systems and helps prevent both intentional misuse and accidental errors from reaching production.

Other controls address different needs. Regular backups protect data recovery, encryption of PANs safeguards data at rest, and periodic vulnerability scans detect weaknesses. But they don’t ensure that developers and production operators operate in separate spaces with controlled handoffs and approvals, which is what this requirement is focused on.