Upon completion of a significant change, which of the following is required?

• A. All relevant PCI DSS requirements implemented on all new or changed systems, with documentation updated.
• B. Only critical PCI DSS requirements are implemented and documented.
• C. Implementations apply only to production systems, not documentation.
• D. No changes to documentation are required.

Answer: (A)

When a significant change is completed, you must bring the environment back into PCI DSS alignment by applying all relevant security requirements to the new or modified systems and updating the supporting documentation. This ensures that the entire changed component operates under the intended controls, provides a clear, auditable record of what was changed, and keeps future maintenance and audits aligned with the actual environment. Skipping some requirements or limiting changes to production without updating documentation creates gaps and confusion, while avoiding changes to documentation leaves the documented state out of sync with reality. Keeping both implementation and documentation current is essential for ongoing compliance and security integrity.