What is required before releasing custom application code to production regarding review?

What is required before releasing custom application code to production regarding review?

• A. Code changes must be reviewed by individuals other than the author and by individuals knowledgeable about code review techniques and secure coding practices
• B. Review is optional
• C. Only automated checks are needed
• D. Management approval alone suffices

Answer: (A)

Before releasing custom application code to production, changes must be reviewed by someone other than the author and by someone knowledgeable about code review techniques and secure coding practices. This ensures an independent, security-focused check of the code, helping to catch defects and potential vulnerabilities before they impact production. Relying solely on automated checks isn’t enough, and requiring only management approval or optional reviews does not provide the necessary technical scrutiny to meet PCI DSS change-management expectations.

Before releasing custom application code to production, changes must be reviewed by someone other than the author and by someone knowledgeable about code review techniques and secure coding practices. This ensures an independent, security-focused check of the code, helping to catch defects and potential vulnerabilities before they impact production. Relying solely on automated checks isn’t enough, and requiring only management approval or optional reviews does not provide the necessary technical scrutiny to meet PCI DSS change-management expectations.