2

I'm doing a questionnaire for PCI compliance and one of the questions (Yes / No / Not Applicable) is as follows:

All custom application code changes are reviewed (either using manual or automated processes) prior to release to production or customers in order to identify any potential coding vulnerability as follows:

  • Code changes are reviewed by individuals other than the originating code author, and by individuals who are knowledgeable in code review techniques and secure coding practices.

So I guess in order to be PCI compliant a company must have at least two developers? 'cause that's sure what it looks like...

Another question (Yes / No / Not Applicable) seems to re-enforce this notion:

Change control processes and procedures are followed for all changes to system components. There are separation of duties between personnel assigned to the development/test environments and those assigned to the production environment.

Improve this question
2
  • 1
    or a 3rd party could review
    – schroeder ♦
    Feb 24, 2021 at 17:30
  • I will point out that if you're not actually handling the credit card data directly (such as using Paypal or Stripe), then "Not Applicable" may be the right choice. Conversely, if you are handling the credit card data directly, think very carefully about whether you have the skill set to handle it securely.
    – Bobson
    Feb 25, 2021 at 4:39

1 Answer 1

Reset to default
2

As @schroeder points out, 3rd parties can perform secure code review. And Production environment practices are better handled by operations staff, not developers - in fact, other regulations like SOX restrict developers from Production access.

So it is possible to be PCI compliant with one developer. The overall requirements of PCI DSS will be difficult for a small (one- or several-person) shop.

Improve this answer
5
  • I get the impression most companies offering "3rd party code reviews" do it as a one off thing. You pay them $10,000 USD and give them a snapshot of your code and they review it. Which is distinctly different than having a developer submit a pull request and having a 3rd party company review it. The former is a one off thing the latter is something you'd have to pay for on a monthly basis until you hired an additional developer.
    – neubert
    Feb 24, 2021 at 20:30
  • Who says the review must be per changeset? Not everything is agile. You could have the developer work for 1 year straight, then after he finishes a new version, get the new release audited prior to release.
    – Ángel
    Feb 24, 2021 at 21:12
  • @Ángel - that works great if the company does releases very infrequently but if it's a SaaS there's no need to go through a formal release cycle like that. Someone could make a change, someone else could review it and that change could be deployed
    – neubert
    Feb 24, 2021 at 21:42
  • 1
    @neubert I'm not saying it would be a good idea to do that. :) In fact, it seems weird that a company used a custom application inside PCI-DSS scope, yet only had a single developer- Moreso that they a 3rd party. If any, I would expect them to outsource development to company A, audit to company B, and the developer to be a project manager.
    – Ángel
    Feb 24, 2021 at 21:47
  • 1
    @neubert I'm sure that code review scope and repetition is something that can be negotiated, allowing for all but the most agile schedules. It'll cost something, but that's the trade-off you make when you decide to go with just one developer. Honestly, I can't think of any facets of development that would benefit from a solo developer, and that's a role I've played more than once.
    – gowenfawr
    Feb 24, 2021 at 22:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .