Is it possible to use any remote DVCS (GitHub, Bitbucket, etc.) with PCI DSS or should I host Git on my own server?
The repo obviously doesn't store any sensitive CHD information and I do have my own self-hosted git repo inside the PCI DSS zone to protect and monitor code entering and exiting the PCI zone.
Not a duplicate of Can I use GitHub and be PCI DSS compliant? - the standard allegedly changed with the 4.0 version and I want to confirm.
In general, the 4.0 version of the standard brings in a lot of new things compared to the previous versions which invalidates a lot of the PCI DSS related answers on the site - which is why I added the PCI DSS 4.0 tag.
The 4.0 version of the standard says in "Section 4: Scope of PCI DSS Requirements" on page 10:
Tools, code repositories, and systems that implement software configuration management or for deployment of objects to the CDE or to systems that can impact the CDE.
and also in "Requirement 6: Develop and Maintain Secure Systems and Software"
Code repositories that store application code, system configurations, or other configuration data that can impact the security of account data or the CDE are in scope for PCI DSS assessments.