Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

Would like to hear from those working in a PCI compliance environment and is practicing agile development and devops methodology, how you maintain compliance with PCI requirements.

Specifically, what do you do to address:

  • separation of duties between development/test and production
  • alignment of continuous integration / deployment and change control
  • alignment of agile stories to requirement documentation
share|improve this question

closed as too broad by gnat, GlenH7, MichaelT, ChrisF Nov 7 '13 at 22:46

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

add comment

1 Answer

Lay down some rules and make sure you document compliance with them.
For example:

  1. Tests must be performed by someone other than the person who coded the solution.
  2. User Acceptance Tests need to be performed by the customer (or a delagate).
  3. Developers do not have access to the production environment.
  4. An Operations person/group is responsible for deploying to the production environment.
  5. When a sprint ends, all accepted code is versioned. The stories completed for that sprint are documented as being part of that version. Generally, we have sprints deal with everything through user acceptance testing, and then authorize a deployment to Prod (or not) at the sprint review. The Operations team should then be able to deploy the approved version.

You'll need several environments in order to handle this. I prefer 5:

  • Dev
  • SIT (System and Integration Testing)
  • UAT (User Acceptance Testing)
  • Production
  • Prod Fix (for fixing urgent Production issues)

User Stories are the general requirements. If you have more detailed requirements, have a matrix indicating in which User Story the detailed requirement is addressed.

share|improve this answer
1  
By the time you do the above, you're not really DevOps and not really Agile... –  DeepSpace101 Nov 6 '13 at 17:42
    
@Sid sometimes the requirements for the environment mandated by an external organization don't work with some methodologies. The PCI 2.0 standards can be read at pcisecuritystandards.org/documents/pci_dss_v2.pdf - Sections 6.3 and 6.4 are likely the ones of the most interest to this question. Though section 7 is also very important (who can access what). –  MichaelT Nov 6 '13 at 18:41
    
Agreed, our hands can be tied. Not taking jabs at you, just lamenting the "created in a vacuum" specs of some standards that impede progress and drag security. –  DeepSpace101 Nov 6 '13 at 18:59
    
@Sid - I suppose I didn't really go into DevOps. I think the key there is to have a ProdFix-type environment mirroring Prod where issues can be dealt with. If you're going to try to comply with any sort of Product Management standards, you're really going to need to make sure changes are made outside of prod, tested, and signed off on. This should not be mutually exclusive with an iterative and adaptive development methodology. –  Matthew Flynn Nov 6 '13 at 23:53
    
@MatthewFlynn well put. They should not be mutually exclusive but getting them to work need adaption. So it is nice learn what other in the same situation had done. Thanks for the insight. –  kenchew Nov 7 '13 at 5:02
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.