Frameworks · Global
Requirement 6.5 asks that each change records its reason, security impact, approval, testing and a way back to a secure state. Aspian Cloud won’t let a production change be approved without them.
- Instrument
- Payment Card Industry Data Security Standard (PCI DSS) v4.0.1
- In force
- Published June 2024; v4.0 retired 31 December 2024, leaving v4.0.1 the only active version; future-dated requirements effective 31 March 2025
- For
- Merchants and service providers that store, process or transmit card data.
| Clause | What it requires | Evidenced by |
|---|---|---|
| Req. 6.5.1 | Production changes record the reason, document security impact, get authorised approval, are tested, and have procedures for failures and returning to a secure state.Source: ce.prod.cloudaware.com | The change record: reason (the linked work item), risk and why, the approval, tests, and the required backout plan. |
| Req. 6.5.2 | After a significant change, confirm all applicable PCI DSS requirements are in place on new or changed systems and update documentation.Source: ce.prod.cloudaware.com | A post-change check that the baseline still passes on the changed system, recorded on the change. |
| Req. 6.5.3 / 6.5.4 | Pre-production environments are separated from production, and roles and functions are separated between them so only reviewed, approved changes reach production.Source: withpci.pages.dev | Promotion order (staging before production), and separate identities: people and agents who propose can’t approve or deploy. |
| Req. 6.5.5 / 6.5.6; Req. 10 | No live card numbers in pre-production; test data and accounts removed before go-live; Requirement 10 requires logging and monitoring of all access to system components and cardholder data.Source: withpci.pages.dev | Policy rules that block secrets and live-looking data in non-production; the signed, append-only audit chain. |
Clause references and requirements were read on 8 November 2026. The standard is paywalled or the official site refused access, so references were confirmed from reputable secondary sources. Aspian Cloud evidences these clauses; it doesn’t make you compliant, and your assessor decides.
Want the mapping for a framework we don’t list? Ask us. A new framework is a data file, not a code change.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.