Can change management for PCI compliance be accomplished via simple emails?

Question

Item 6.4.5 of PCI DSS requires the following:

6.4.5 Change control procedures for the implementation of security patches and software modifications. Procedures must include the following:

6.4.5.1 Documentation of impact. 6.4.5.2 Documented change approval by authorized parties.

6.4.5.3 Functionality testing to verify that the change does not adversely impact the security of the system.

6.4.5.4 Back-out procedures.

We could use full-blown ITIL-compatible software for this. But it seems overkill for a small company (less than 10 employees). We would like to satisfy that requirement in the simplest possible manner.

For example, suppose all these items are managed via a simple email. Whenever a change is necessary, a request for change (RfC) should be sent to a specific email address with all the necessary information (justification, back-out procedures etc). Someone in the role of change manager would manage that email box and approve or reject all incoming RfCs and take the necessary actions, such as notify the sysadmin or schedule the change.

Is it acceptable in terms of PCI compliance?

Answer 1

We used email for change management for a while, and as long as we had a record of it, our auditor was satisfied. However, email is seriously lacking in features and not well-suited to the task. It's difficult to track, and hanging onto a string of emails and then providing them at audit time is a nightmare.

However, it's easier with other forms of software designed for tracking tickets. You can find decent, free CRM or helpdesk ticket software that can be used to track change tickets just as easily as a full blown ITIL package, but with less features. The critical components are that you can track what is changing, who authorized the change, and the steps taken. This can be achieved through ticketing software that has the following features:

• Allows you to record basic incident/call details
• Allows you to assign tickets to people or groups
• Allows you to enter notes
• Allows easy reporting, or at least access to the database so you can write your own reports.
• Bonus if it allows you to attach files and does so in a secure way. This allows you to attach code review documents, threat models, or other artifacts associated with the change.
• Bonus if it has workflow modules to to allow for approval processes (although those can be defined and just done manually)

The more detailed and specific the tracking/logs, the better.

Answer 2

Agree with above.

But as long as your email trail meets the objectives of the control then you are covered. After all you are trying to ensure that you have an auditable control i.e. someone can come along, ask for a list of changes then request evidence that you have tested them, and your procedures are documented etc

Email might not be the best tool for the job but it does suffice.

Answer 3

Email does the job but a ticketing solution will help in the long run.

One concern I always had with email - especially in small organizations - is it is too easy to delete content. A good ticketing system can be set up to not allow ticket deletion and easy auditing of user behavior and access patterns as David pointed out.

My day job is a non profit and the developers use Jira for bug tracking. With a few workflow simplifications it is working exceedingly well for our change control, PCI requirements included. Might me a good starting point if you're not familiar with your options.