User Acceptance Testing (UAT)
PCIComplianceHubLast updated
A phase of software development where the intended users test the system to ensure it meets their requirements and functions correctly. UAT can help organizations identify and remediate potential security issues before they impact cardholder data and PCI DSS compliance.
Applies to. PCI DSS v4.0.1 does not name UAT. Where it happens on in-scope software it is a pre-production stage under Requirement 6, which asks that test environments are separated from production with access controls enforcing that separation, that live PANs are not used for testing unless the environment sits inside the CDE and is protected as production, and that test data and test accounts are removed before the system goes live. Any change that passes UAT still goes through the documented change control procedure that Requirement 6 requires before it reaches production.
Related. SDLC (Software Development Life Cycle), Change Control, Change Management, Bespoke and Custom Software, Secure Coding
Sources. PCI DSS v4.0.1 (June 2024)