4

PCI-DSS 3 requirement 6.4.2 calls for

Separation of duties between development/test and production environments.

Based on the guidance text and this, answer to another question, it appears that the purpose of this requirement is to ensure that no one person holds all the access.

While this is easy enough in a large company, does this automatically mean that a 1 person company (or a company small enough to be unable to afford hiring separate DBAs and syadmins for each environment) cannot possibly be PCI-DSS compliant?

  • Technically, you are correct that a 1-person shop would not apply, but you'd need to talk to your QSA for a final ruling. – schroeder Mar 25 '15 at 20:20
  • 5
    Most one-man bands avoid PCI by outsourcing credit card payments to PayPal, WorldPay, etc. – paj28 Mar 25 '15 at 20:35
3

In general, a shop which is that small will not handle credit card processing directly. They will outsource that functionality to a 3rd party which is PCI compliant. The responsibility will be to ensure the 3rd party is compliant.

If this is not an option, then it will be necessary to put other controls in place which will satisfies your QSA. What these controls will need to be will depend o the volume of credit card transactions you process. This could be things like higher logging and more frequent external auditing, role rotation, establishing processes where multiple individuals need to participate in applying changes in production etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.