4

PCI-DSS 3 requirement 6.4.2 calls for

Separation of duties between development/test and production environments.

Based on the guidance text and this, answer to another question, it appears that the purpose of this requirement is to ensure that no one person holds all the access.

While this is easy enough in a large company, does this automatically mean that a 1 person company (or a company small enough to be unable to afford hiring separate DBAs and syadmins for each environment) cannot possibly be PCI-DSS compliant?

Improve this question
2
  • Technically, you are correct that a 1-person shop would not apply, but you'd need to talk to your QSA for a final ruling.
    – schroeder ♦
    Commented Mar 25, 2015 at 20:20
  • 5
    Most one-man bands avoid PCI by outsourcing credit card payments to PayPal, WorldPay, etc.
    – paj28
    Commented Mar 25, 2015 at 20:35

1 Answer 1

Reset to default
3

In general, a shop which is that small will not handle credit card processing directly. They will outsource that functionality to a 3rd party which is PCI compliant. The responsibility will be to ensure the 3rd party is compliant.

If this is not an option, then it will be necessary to put other controls in place which will satisfies your QSA. What these controls will need to be will depend o the volume of credit card transactions you process. This could be things like higher logging and more frequent external auditing, role rotation, establishing processes where multiple individuals need to participate in applying changes in production etc.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .