In planning the next phase of our platform, I am trying to ensure that the production deployment process is PCI compliant.
We have a central platform which acts as a CMS, serving custom content based on an event type, that will reside in a hardened IIS server/environment.
Each new event has a basic splash screen and a custom domain name, i.e. www.myevent1.com, www.myevent2.com, etc.
The issue is that we will need to add new domain names frequently. Being PCI-compliant, we can't have developers accessing production servers.
PCI-DSS 6.4 states:
A separation of duties between personnel that are assigned to the development/test environments and those persons assigned to the production environment.
I'm trying to maintain the separation of tasks per compliance specs.
Thus, I my thoughts were to maintain the CMS server as-is, fully hardened - no developer access. Then have a secondary IIS server where developers can add new domains as needed, and upload the static splash pages that link to the CMS content.
-- UPDATE --
We will be using PCI-DSS Level 4 compliance, so we won't have any card-holder data on our servers. The payment processor will have this info.