Item 6.4.5 of PCI DSS requires the following:
6.4.5 Change control procedures for the implementation of security patches and software modifications. Procedures must include the following:
126.96.36.199 Documentation of impact. 188.8.131.52 Documented change approval by authorized parties.
184.108.40.206 Functionality testing to verify that the change does not adversely impact the security of the system.
220.127.116.11 Back-out procedures.
We could use full-blown ITIL-compatible software for this. But it seems overkill for a small company (less than 10 employees). We would like to satisfy that requirement in the simplest possible manner.
For example, suppose all these items are managed via a simple email. Whenever a change is necessary, a request for change (RfC) should be sent to a specific email address with all the necessary information (justification, back-out procedures etc). Someone in the role of change manager would manage that email box and approve or reject all incoming RfCs and take the necessary actions, such as notify the sysadmin or schedule the change.
Is it acceptable in terms of PCI compliance?