PCI DSS 6.5.5: Live PANs are not used in pre-production environments
PCI DSS v4.0.1 control 6.5.5: the requirement in full, the 3 testing procedures an assessor uses to verify it, and the related controls in section 6.5.
Requirement 6: Develop and Maintain Secure Systems and Software › Section 6.5
Live PANs are not used in pre-production environments, except where those environments are included in the CDE and protected in accordance with all applicable PCI DSS requirements.
Summary
Do not put real card numbers in test environments, unless that environment is inside the CDE and meets every requirement.
What the assessor will examine
These are the testing procedures the standard defines for this control. They tell you what evidence to have ready.
| Procedure | |
|---|---|
| 6.5.5.a | Examine policies and procedures to verify that processes are defined for not using live PANs in pre-production environments, except where those environments are in a CDE and protected in accordance with all applicable PCI DSS requirements. |
| 6.5.5.b | Observe testing processes and interview personnel to verify procedures are in place to ensure live PANs are not used in pre-production environments, except where those environments are in a CDE and protected in accordance with all applicable PCI DSS requirements. |
| 6.5.5.c | Examine pre-production test data to verify live PANs are not used in pre-production environments, except where those environments are in a CDE and protected in accordance with all applicable PCI DSS requirements. |
The exception is real and it is expensive, which is the practical content of this control. Live PANs may be used in pre-production where that environment is included in the CDE and protected in accordance with all applicable PCI DSS requirements, and that means the test environment inherits encryption, access control, logging, monitoring, scanning and everything else. Most entities that read the exception carefully choose test data instead. The three procedures escalate: 6.5.5.a examines the policy, 6.5.5.b observes testing processes, and 6.5.5.c examines the pre-production test data itself, so this is checked in the data rather than asserted. Note that the common route in is not a decision but a habit: production is copied to test because it is the fastest way to reproduce a bug.
What to prepare
- The policy, and whether you are claiming the exception.
- How test data is generated or masked.
- The pre-production data itself, which is examined directly.
- The refresh process from production, if one exists.
How to implement it
1. Mask or synthesise at the point of copy. A refresh process that de-identifies as it runs is the only reliable answer, because manual scrubbing after the fact misses columns.
2. Use test PANs from the card brands. They are designed for this and remove the argument entirely.
3. Look for the ad hoc copies. A support engineer's extract to reproduce a bug is how live PANs reach test without any process being involved, and it is what 6.5.5.c finds.
4. Price the exception before claiming it. Bringing a test environment into the CDE applies the whole standard to it, which is usually more work than fixing the test data.
Where this commonly fails
- Production restored into test for troubleshooting, with nobody treating it as a scope change.
- Masking applied to obvious columns and missing PANs in free text, logs or attachments.
- The exception claimed without the test environment actually meeting the requirements.
- Historic test data from before the policy, still present and still live.
Related controls
Others in section 6.5:
| Control | What it requires |
|---|---|
| 6.5.1 | Changes to all system components in the production environment are made according… |
| 6.5.2 | Upon completion of a significant change, all applicable PCI DSS requirements are confirmed… |
| 6.5.3 | Pre-production environments are separated from production environments and the separation… |
| 6.5.4 | Roles and functions are separated between production and pre-production environments to provide… |
| 6.5.6 | Test data and test accounts are removed from system components before the system goes into… |
← 6.5.4 · All controls · 6.5.6 →
Source
The requirement text and testing procedures above are reproduced from PCI DSS v4.0.1 (June 2024), ©2006-2024 PCI Security Standards Council, LLC. All rights reserved. The commentary is our own.
The official standard is authoritative and also contains the Customized Approach Objective, applicability notes and guidance for this control. Download it from the PCI Security Standards Council document library. PCI DSS is a registered standard of the PCI Security Standards Council, LLC, which does not endorse this site. Nothing here is a substitute for advice from a Qualified Security Assessor.