Identify the sample of:
i. System components
ii. Recent custom code changes/updates
For each sampled custom code change:
i. Describe how details of testing for compliance with PCI DSS Requirement 6.5 (to address the vulnerabilities defined in 6.5.1 – 6.5.9) are included in the change control documentation.
ii. Describe how the testing performed verifies that all updates are compliant with PCI DSS Requirement 6.5 (6.5.1 – 6.5.9) before being deployed into production.