Requirement 6: Develop and Maintain Secure Systems and Software
Actors with bad intentions can use security vulnerabilities to gain privileged access to systems. All system components must have all appropriate software patches. Code repositories that store application code, system configurations, or other configuration data that can impact the security of account data or the CDE are in scope for PCI DSS assessments.
Much of requirement 6 applies only to organizations that develop applications that are used in your cardholder data environment such as websites and APIs that accept payments, or applications that process cardholder information. However, there are parts of requirement 6 that apply to all organizations, even if no development is performed:
A process must be in place to identify relevant security vulnerabilities as they emerge. Reputable industry resources such as Microsoft Security Bulletins and Cisco Security Advisories should be monitored to identify new threats such as operating system vulnerabilities and critical patches. All identified vulnerabilities should be assigned a risk ranking such as “high”, “medium”, or “low” based on the risk and critical nature of affected systems so that risk mitigation efforts can be prioritized appropriately. All systems and software must be protected from known vulnerabilities by installing critical security patches within one month of release, and all non-critical security releases should be installed within about three months of release.
Documented change control records and a testing environment should be used to verify the proper functionality of new systems and changes before they are implemented in the production environment. Live card numbers must not be used for testing purposes, and all test accounts must be removed from systems before they are migrated to the production environment. Development and testing roles must be kept separate from production roles (separation of duties). In addition, the same username and password combinations must not be used for both the test and production environments.
Organizations that develop applications for use in the CDE must also maintain the following requirements:
All custom code must be reviewed by someone other than the author and approved by management before it is pushed to the production environment. All developers must be trained annually to avoid common security vulnerabilities such as those outlined in the OWASP Top Ten or the CWE Top 25 (maintained by MITRE). Training records must be maintained to include course topics and attendance/completion records for all developers (Requirement 6.2.2). Developers must also be trained to address common software attacks, per Requirement 6.2.4.
Custom public-facing web applications must be protected from web-based attacks by an automated technical solution — such as a web application firewall (WAF) — that continually detects and prevents web-based attacks (Requirement 6.4.2, mandatory since March 31, 2025). This solution must sit in front of the application, run actively, stay up to date, generate logs, and either block attacks or generate an alert that is reviewed and responded to promptly. Code review or scanning alone no longer satisfies this requirement. Payment page scripts must also be authorized, integrity-assured, and inventoried with a documented business justification for each (Requirement 6.4.3).
Go on to Requirement 7 - Restricted Access.
Go back to Requirement 5 - Anti Virus and Malware.