Would like to hear from those working in a PCI compliance environment and is practicing agile development and devops methodology, how you maintain compliance with PCI requirements.

Specifically, what do you do to address:

  • separation of duties between development/test and production
  • alignment of continuous integration / deployment and change control
  • alignment of agile stories to requirement documentation

closed as too broad by gnat, user53019, user40980, ChrisF Nov 7 '13 at 22:46

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


Lay down some rules and make sure you document compliance with them.
For example:

  1. Tests must be performed by someone other than the person who coded the solution.
  2. User Acceptance Tests need to be performed by the customer (or a delagate).
  3. Developers do not have access to the production environment.
  4. An Operations person/group is responsible for deploying to the production environment.
  5. When a sprint ends, all accepted code is versioned. The stories completed for that sprint are documented as being part of that version. Generally, we have sprints deal with everything through user acceptance testing, and then authorize a deployment to Prod (or not) at the sprint review. The Operations team should then be able to deploy the approved version.

You'll need several environments in order to handle this. I prefer 5:

  • Dev
  • SIT (System and Integration Testing)
  • UAT (User Acceptance Testing)
  • Production
  • Prod Fix (for fixing urgent Production issues)

User Stories are the general requirements. If you have more detailed requirements, have a matrix indicating in which User Story the detailed requirement is addressed.

  • 2
    By the time you do the above, you're not really DevOps and not really Agile... – DeepSpace101 Nov 6 '13 at 17:42
  • @Sid sometimes the requirements for the environment mandated by an external organization don't work with some methodologies. The PCI 2.0 standards can be read at pcisecuritystandards.org/documents/pci_dss_v2.pdf - Sections 6.3 and 6.4 are likely the ones of the most interest to this question. Though section 7 is also very important (who can access what). – user40980 Nov 6 '13 at 18:41
  • Agreed, our hands can be tied. Not taking jabs at you, just lamenting the "created in a vacuum" specs of some standards that impede progress and drag security. – DeepSpace101 Nov 6 '13 at 18:59
  • @Sid - I suppose I didn't really go into DevOps. I think the key there is to have a ProdFix-type environment mirroring Prod where issues can be dealt with. If you're going to try to comply with any sort of Product Management standards, you're really going to need to make sure changes are made outside of prod, tested, and signed off on. This should not be mutually exclusive with an iterative and adaptive development methodology. – Matthew Flynn Nov 6 '13 at 23:53
  • @MatthewFlynn well put. They should not be mutually exclusive but getting them to work need adaption. So it is nice learn what other in the same situation had done. Thanks for the insight. – kenchew Nov 7 '13 at 5:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.