I'm doing a questionnaire for PCI compliance and one of the questions (Yes / No / Not Applicable) is as follows:
All custom application code changes are reviewed (either using manual or automated processes) prior to release to production or customers in order to identify any potential coding vulnerability as follows:
- Code changes are reviewed by individuals other than the originating code author, and by individuals who are knowledgeable in code review techniques and secure coding practices.
So I guess in order to be PCI compliant a company must have at least two developers? 'cause that's sure what it looks like...
Another question (Yes / No / Not Applicable) seems to re-enforce this notion:
Change control processes and procedures are followed for all changes to system components. There are separation of duties between personnel assigned to the development/test environments and those assigned to the production environment.